Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Atomic now has --user flag. #483

Merged
merged 1 commit into from Jul 26, 2016

Conversation

@mtohmaz
Copy link

commented Jul 15, 2016

Atomic now has --user flag which creates a BARE_USER repo locally to allow non-privileged user to pull images.

@rhatdan

This comment has been minimized.

Copy link
Member

commented Jul 15, 2016

I need man page changes, test suite, bash completions...

@giuseppe

This comment has been minimized.

Copy link
Member

commented Jul 15, 2016

I'd move the logic of the new function _get_local_ostree_repo into the existing _get_ostree_repo as the two differences (path and use OSTree.RepoMode.BARE_USER) can be easily managed there. _get_ostree_repo is already used in other places, so I think it is better to check if it is running as user only in one place (_get_ostree_repo).

More important: how is an user image going to look like? The current system images use runc and systemd, while, I assume, we will use bubblewrap for user images. We will need to store some extra information on how the user image is installed and executed. Where this information will be? How installing and executing an user image will look like?

@rhatdan

This comment has been minimized.

Copy link
Member

commented Jul 16, 2016

Yes that is what we need to begin designing. We need some kind of local configuration to define how to run a bubblewrap container, a possible solution would be to drop a OCI specification and then have a tool to translate OCI Specs to bubblewrap CLI.

@giuseppe

This comment has been minimized.

Copy link
Member

commented Jul 16, 2016

would it reasonable to add OCI specs support to bubblewrap so that the same configuration (and to some extend the same process to install an image) can be used?

@rhatdan

This comment has been minimized.

Copy link
Member

commented Jul 17, 2016

There is real reluctance to add any kind of object processing to a SETUID app. So it would be preferred that this happens in non priv mode before executing the SETUID app.

@rhatdan

This comment has been minimized.

Copy link
Member

commented Jul 18, 2016

@mtohmaz Man pages? Command Completion? Tests?

@cgwalters PTAL

@mtohmaz

This comment has been minimized.

Copy link
Author

commented Jul 18, 2016

I'm still working on the tests, but I'll push everything once I finish them this morning.

@giuseppe

This comment has been minimized.

Copy link
Member

commented Jul 18, 2016

I've spent some time during the weekend to write a wrapper around bubblewrap that reads the configuration from an OCI conf file and generates the command line for bubblewrap:

https://github.com/giuseppe/bubblewrap/tree/bwrap-oci

Still it is far from being complete, it lacks many options and it is quite hacky/buggy, but it can be used as a starting point:

$ sudo dnf install--releasever 24 --installroot=rootfs emacs
$ ocitools generate --tty --args /usr/bin/emacs > config.json
$ bwrap-oci
# ...emacs running..
@jlebon

This comment has been minimized.

Copy link
Member

commented Jul 19, 2016

bot, retest this please

@rh-atomic-bot

This comment has been minimized.

Copy link

commented Jul 20, 2016

☔️ The latest upstream changes (presumably eeac733) made this pull request unmergeable. Please resolve the merge conflicts.

@rhatdan

This comment has been minimized.

Copy link
Member

commented Jul 20, 2016

@mtohmaz Needs a rebase.

@rhatdan

This comment has been minimized.

Copy link
Member

commented Jul 25, 2016

@mtohmaz PTAL

Mahmoud Tohmaz mtohmaz
@jlebon

This comment has been minimized.

Copy link
Member

commented Jul 26, 2016

bot, retest this please

@rhatdan rhatdan merged commit 3d18350 into projectatomic:master Jul 26, 2016
1 check failed
1 check failed
Jenkins (Red Hat Internal) Tests failed with rc 2.
Details
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants
You can’t perform that action at this time.