Skip to content

Commit 7650cd8

Browse files
jiridanekjiridanek
authored
RHOAIENG-16076: tests(gha): change to using rootful podman, so that we can share containers/storage with cri-o later (#782)
1 parent 4a1646b commit 7650cd8

File tree

7 files changed

+94
-25
lines changed

7 files changed

+94
-25
lines changed

‎.github/workflows/build-notebooks-TEMPLATE.yaml

Lines changed: 42 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,12 @@ jobs:
2020
build:
2121
runs-on: ubuntu-22.04
2222
env:
23+
# Some pieces of code (image pulls for example) in podman consult TMPDIR or default to /var/tmp
24+
TMPDIR: /home/runner/.local/share/containers/tmpdir
25+
# Use the rootful instance of podman for sharing images with cri-o
26+
# https://podman-desktop.io/blog/sharing-podman-images-with-kubernetes-cluster#introduction
27+
# https://access.redhat.com/solutions/6986565
28+
CONTAINER_HOST: unix:///var/run/podman/podman.sock
2329
# We don't push here when building PRs, so we can use the same IMAGE_REGISTRY in all branches of the workflow
2430
IMAGE_REGISTRY: "ghcr.io/${{ github.repository }}/workbench-images"
2531
# GitHub image registry used for storing $(CONTAINER_ENGINE)'s cache
@@ -101,22 +107,45 @@ jobs:
101107

102108
- name: Configure Podman
103109
run: |
104-
set -x
105-
mkdir -p $HOME/.config/containers/
106-
cp ci/cached-builds/containers.conf $HOME/.config/containers/containers.conf
107-
cp ci/cached-builds/storage.conf $HOME/.config/containers/storage.conf
108-
109-
# should at least reset storage when touching storage.conf
110-
podman system reset --force
110+
set -Eeuxo pipefail
111+
112+
# podman running as service ignores the TMPDIR env var here, let's give it a bind-mount to /var/tmp
113+
mkdir -p $TMPDIR
114+
sudo mount --bind -o rw,noexec,nosuid,nodev,bind $TMPDIR /var/tmp
115+
116+
# podman from brew has its own /etc (was giving me Failed to obtain podman configuration: runroot must be set)
117+
# the (default) config location is also where cri-o gets its storage defaults (that can be overriden in crio.conf)
118+
sudo cp ci/cached-builds/containers.conf /etc/containers.conf
119+
sudo cp ci/cached-builds/containers.conf /home/linuxbrew/.linuxbrew/opt/podman/etc/containers.conf
120+
sudo cp ci/cached-builds/storage.conf /etc/containers/storage.conf
121+
sudo cp ci/cached-builds/storage.conf /home/linuxbrew/.linuxbrew/opt/podman/etc/containers/storage.conf
122+
sudo cp ci/cached-builds/registries.conf /etc/containers/registries.conf
123+
sudo cp ci/cached-builds/registries.conf /home/linuxbrew/.linuxbrew/opt/podman/etc/containers/registries.conf
124+
125+
# should reset storage when changing storage.conf
111126
mkdir -p $HOME/.local/share/containers/storage/tmp
127+
# remote (CONTAINER_HOST) podman does not do reset (and refuses --force option)
128+
sudo /home/linuxbrew/.linuxbrew/opt/podman/bin/podman system reset --force
112129
113-
# start systemd user service
130+
# https://github.com/containers/podman/blob/main/docs/tutorials/socket_activation.md
114131
# since `brew services start podman` is buggy, let's do our own brew-compatible service
115-
mkdir -p "${HOME}/.config/systemd/user/"
116-
cp ci/cached-builds/homebrew.podman.service "${HOME}/.config/systemd/user/homebrew.podman.service"
117-
systemctl --user daemon-reload
118-
systemctl --user start homebrew.podman.service
119-
echo "PODMAN_SOCK=/run/user/${UID}/podman/podman.sock" >> $GITHUB_ENV
132+
# Regarding directory paths, see https://unix.stackexchange.com/questions/224992/where-do-i-put-my-systemd-unit-file
133+
sudo mkdir -p /usr/local/lib/systemd/system/
134+
sudo cp ci/cached-builds/podman.service /usr/local/lib/systemd/system/podman.service
135+
sudo cp ci/cached-builds/podman.socket /usr/local/lib/systemd/system/podman.socket
136+
sudo systemctl daemon-reload
137+
sudo systemctl unmask --now podman.service podman.socket
138+
sudo systemctl start podman.socket
139+
140+
# needed (much) later for trivy
141+
echo "PODMAN_SOCK=/var/run/podman/podman.sock" >> $GITHUB_ENV
142+
143+
# quick check podman works
144+
podman ps
145+
146+
- name: Show error logs (on failure)
147+
if: ${{ failure() }}
148+
run: journalctl -xe
120149

121150
- name: Calculate image name and tag
122151
id: calculated_vars

‎ci/cached-builds/containers.conf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,13 @@ retry=100
88
# supposedly these images are faster to pull
99
compression_format="zstd:chunked"
1010
compression_level=6
11+
1112
# defaults to /var/tmp, which is small
1213
image_copy_tmp_dir="storage"
14+
# setting image_copy_tmp_dir is not enough, it still can give me
15+
# Error: creating build container: writing blob: storing blob to file "/var/tmp/container_images_storage2384030476/20": write /var/tmp/container_images_storage2384030476/20: no space left on device
16+
# https://github.com/containers/podman/issues/5411, https://github.com/containers/podman/pull/5412
17+
# Set the TMPDIR env variable, https://github.com/containers/podman/blob/d85ac938e60938369ff1337dccaf0943b7405f48/cmd/podman/images/load.go#L96
1318

1419
[machine]
1520

‎ci/cached-builds/homebrew.podman.service

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎ci/cached-builds/podman.service

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# https://docs.podman.io/en/latest/markdown/podman-system-service.1.html
2+
# cat /usr/lib/systemd/system/podman.socket
3+
4+
[Unit]
5+
Description=Podman API Service
6+
Requires=podman.socket
7+
After=podman.socket
8+
Documentation=man:podman-system-service(1)
9+
StartLimitIntervalSec=0
10+
11+
[Service]
12+
Delegate=true
13+
Type=exec
14+
KillMode=process
15+
Environment="PATH=/home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin:/usr/bin:/bin:/usr/sbin:/sbin"
16+
WorkingDirectory=/home/linuxbrew/.linuxbrew
17+
ExecStart=/home/linuxbrew/.linuxbrew/opt/podman/bin/podman --log-level=info system service
18+
19+
[Install]
20+
WantedBy=default.target

‎ci/cached-builds/podman.socket

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# cat /usr/lib/systemd/system/podman.socket
2+
3+
[Unit]
4+
Description=Podman API Socket
5+
Documentation=man:podman-system-service(1)
6+
7+
[Socket]
8+
ListenStream=%t/podman/podman.sock
9+
SocketMode=0666
10+
11+
[Install]
12+
WantedBy=sockets.target

‎ci/cached-builds/registries.conf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md
2+
3+
# prevent this kyverno error
4+
# Failed to pull image "bitnami/kubectl:1.26.4": reading manifest 1.26.4 in quay.io/bitnami/kubectl: unauthorized: access to the requested resource is not authorized
5+
unqualified-search-registries = [ "docker.io" ]
6+
short-name-mode = "enforcing"

‎ci/cached-builds/storage.conf

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,15 @@
11
# https://github.com/containers/storage/blob/main/docs/containers-storage.conf.5.md
22

3+
# Multiple users sharing the same containers/storage is not "supported" as it tends to cause
4+
# various permission issues on the host or wrong uid/gids in the containers. C.f.
5+
# https://access.redhat.com/solutions/6986565
36
[storage]
4-
driver="overlay"
7+
driver = "overlay"
8+
9+
graphroot = "/home/runner/.local/share/containers/storage"
10+
runroot = "/home/runner/.local/share/containers/storage"
11+
12+
transient_store = true
513

614
[storage.options]
715
# https://www.redhat.com/sysadmin/faster-container-image-pulls

0 commit comments

Comments
 (0)