Skip to content
This repository has been archived by the owner on Jan 8, 2023. It is now read-only.

Keep the same level of privileges when running with rootless: False #35

Closed
wants to merge 1 commit into from
Closed

Keep the same level of privileges when running with rootless: False #35

wants to merge 1 commit into from

Conversation

BenjaminSchubert
Copy link

This fixes multiple bugs:

  • Create/destroy, wait on the previous task as root too. Otherwise the
    task fails, as it doesn't have access to the job

  • Build the image with the same user

Notes

This fixes multiple bugs:

- Create/destroy, wait on the previous task as root too. Otherwise the
  task fails, as it doesn't have access to the job

- Build the image with the same user
@BenjaminSchubert
Copy link
Author

Alternatively, we could also only become root for the commands requiring podman, so that sudo rules could be simpler

@sshnaidm
Copy link
Collaborator

sshnaidm commented Mar 20, 2021

TBH all this rootless/rootfull config seems redundant there and doesn't really work. I think we need just to run molecule with sudo to get rootfull containers to work.

Copy link
Member

@ssbarnea ssbarnea left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am inclined to agree with @sshnaidm on this and I do have two additional issues to point:

  • if we use become only on some tasks we are prone to get surprises
  • using default(true) would be bad because ansible default is false, not true.

@ssbarnea
Copy link
Member

Closing as this is unlikely to be merged in current form. Still, I am open to suggestion for improving the experience, like detecting when root is needed and missing and warning the user. Still, I do think that the default behavior of using non-root is better from the security point of view.

@ssbarnea ssbarnea closed this Jun 16, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants