Huge (sparse) files /var/log/lastlog and /var/log/faillog trouble docker

[tornaria]

The files /var/log/lastlog and /var/log/faillog store records per user offset by a multiple of user id. Since cocalc uses huge user ids for projects, they result in huge files, which are not in principle a problem (they are stored as files with holes).

However, this creates trouble with some docker functions (e.g. docker commit for sure, and maybe docker export as well), since they create a copy of the file sequentially which takes a long time and disk space (hundreds of gigabytes).

One possible solution:

• use option -l for useradd to avoid initializing those files when project-user creation
• configure the login process to avoid extending those files when login to a project via ssh (not tested: I think one can do this by removing pam_lastlog from /etc/pam.d/login)

Alternative (simpler) solution:

• just remove /var/log/faillog and /var/log/lastlog as both useradd and pam_lastlog do not create the file if it doesn't exist

I think both solutions are functionally equivalent; the second one is trivial to do on a running container without any source changes (so it could just be a quick hint in the documentation).

What is lost: those files register the last login time, and failed login time, so the only thing missing seems to be the line "Last login time: xxxx" at login time, which won't show up.

It's very easy to reenable the feature: just touch /var/log/{last,fail}log to create empty files which will then be used (and thus extended to huge-files-with-holes).

Note that similar (and more) information can still be obtained using last and lastb commands which use the data from /var/log/wtmp and /var/log/btmp and don't suffer from this huge-file issue.

Edit: I think wtmp will still be updated as long as the second solution is used. With the first solution accounting will not be done at all, since it's the same pam_lastlog which updates wtmp. It'd be cool if pam_lastlog would print the information from wtmp if the other file is missing, but that doesn't seem to be the case.

[tornaria]

Related (but no solution to be found there):
https://bugzilla.redhat.com/show_bug.cgi?id=1244300
https://bugzilla.redhat.com/show_bug.cgi?id=192560

[haraldschilly]

Oh, good points, so, in essence, this is a problem with docker after such a user has been created. We should at least explain this in the documentation.

[williamstein]

Move this to new Docker repo?

[williamstein]

Closing — this should be at sagemathinc/cocalc-docker#6