%pre script causes the agent not to install on rpm-ostree versions of RHEL

[mrguitar]

I'm testing the install of aziot-edge-1.4.9-1.el8.x86_64.rpm on a RHEL 8 edge image. It's basically a RHEL 8 system, w/ the same rpms but put together with rpm-ostree to make it more resilient in edge environments.

rpm-ostree executes the package install inside a bubblewrap container before it's layered on the underlying host OS.
The %pre script queries for the docker group on the host to serve as a check to ensure a container engine is installed. Unfortunately this causes the install to fail as we cannot view this group from inside the bwrap container.

iotedge/edgelet/contrib/centos/aziot-edge.spec

Line 66 in dc5c99e

if ! /usr/bin/getent group docker >/dev/null; then

Is it possible to drop this check and use a regular rpm dependency instead?

[jlian]

@brotherneeru please help investigate feasibility

[bilalsellak]

Had to do some asking around, but looks like we intentionally don't use an RPM dependency because we want to allow people to use docker for non-production scenarios.

The current situation is that we require the user to install moby-engine first and aziot-edge second. Looks like that should work for rpm-ostree too.

[Gunni]

Would it not be possible to put a pre-dependency on containerd instead? That way anything that satisfies Provides: containerd would satisfy it, and allow us to install aziot-edge in one transaction.

We are bootstrapping our system via debootstrap where every single package to be installed is done within a single Apt transaction. We don't have a way to tell Apt ourselves the order of package installation.

[mrguitar]

@brotherneeru , thanks for looking into this. The reason you went this direction makes perfect sense to me. Similar to @Gunni 's situation, we're using https://github.com/osbuild/osbuild-composer/ to create images as well as generate day-2 updates to systems deployed at the edge. Unfortunately, our tooling doesn't let us do multiple-step installs as you describe.

I like the idea of depending on containerd. I believe that would probably better satisfy the need to support moby & docker than querying a group.

[arsing]

Would it not be possible to put a pre-dependency on containerd instead? That way anything that satisfies Provides: containerd would satisfy it, and allow us to install aziot-edge in one transaction.

Yes, we have already investigated in the past to depend on something that both packages provide. The problem there isn't such a thing, certainly not containerd:

$ rpm -q --provides docker-ce   # From Docker's repo

docker-ce = 3:23.0.1-1.el8
docker-ce(x86-64) = 3:23.0.1-1.el8

$ rpm -q --provides moby-engine   # From MS repo

config(moby-engine) = 20.10.23+azure-2.el8
moby-engine = 20.10.23+azure-2.el8
moby-engine(x86-64) = 20.10.23+azure-2.el8

---

Another problem is that the docker-ce / moby-engine packages create the group in their postinst script:

$ rpm -q --scripts docker-ce

postinstall scriptlet (using /bin/sh):

if [ $1 -eq 1 ] ; then 
        # Initial installation 
        systemctl --no-reload preset docker.service &>/dev/null || : 
fi 

if ! getent group docker > /dev/null; then
    groupadd --system docker
fi

<snip>

$  rpm -q --scripts moby-engine

postinstall scriptlet (using /bin/sh):
if ! grep -q "^docker:" /etc/group; then
	groupadd --system docker
fi

<snip>

... but we require the group to exist in aziot-edge's preinst script, so depending on a docker-providing package wouldn't help anyway. That said, I'm not sure there's a reason we need it in preinst; it'll probably be fine to move it to postinst.

[Gunni]

The problem there isn't such a thing

Then it might be time to make a feature request for all parties for such a feature, and then modify the moby-containerd to have it and then start depending on it.

we require the group to exist in aziot-edge's preinst script

That's what Pre-Depends is meant to solve. And also why I said pre-dependency in my comment earlier.

[arsing]

then modify the moby-containerd to have it and then start depending on it.

The group is created by docker-ce / moby-engine, not moby-containerd.

[Gunni]

The group is created by docker-ce / moby-engine, not moby-containerd.

Fine but my point stands, a common dependency that can be "provided" by multiple sources.

[veyalla]

Adding @cpuguy83 for his thoughts..

[cpuguy83]

Depending on a common "Provides" keyword would be ideal however neither the docker-ce packaging nor our packaging have anything here.

You should be able to do something like Requires: (moby-engine or docker-ce).
This may not work on rhel7... the feature was added to rpm 4.13... but you can handle this in the rpm spec with a macro (and rhel7 will just behave like it does today).

[cpuguy83]

For reference: https://rpm-software-management.github.io/rpm/manual/boolean_dependencies.html