Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

services.setup: Pull Grafana image from docker.io #3388

Merged
merged 3 commits into from
May 24, 2022
Merged

services.setup: Pull Grafana image from docker.io #3388

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f77fb92
services.setup: Pull Grafana image from docker.io
allisonkarlitskaya May 17, 2022
9334509
services.setup: workaround podman symlink relabelling bug
allisonkarlitskaya May 17, 2022
4badfdd
images: Update services image
May 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions images/scripts/services.setup
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,12 @@ EOF
chmod 755 /root/run-freeipa
/root/run-freeipa

# HACK: Podman fails to relabel symlinks properly, accidentally relabelling their targets instead
# https://github.com/opencontainers/selinux/pull/173
# Disable relabelling for subsequent runs and make SELinux permissive.
sed -i 's/data:Z/data/' /root/run-freeipa
Copy link
Member

@mvollmer mvollmer May 23, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Without properly labeled files, we need to switch off SELinux entirely.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like it shouldn't be necessary. The logic here is that we need to relabel the first time we run it because the empty directory should have the correct label. After that, everything in that directory will have been created by the container itself and shouldn't need relabelling.

At the same time

  • this is the services image
  • this is a workaround for a known bug in the image
  • we have better things to work on

So 👍 to disabling selinux to deal with this.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The logic here is that we need to relabel the first time we run it because the empty directory should have the correct label.

I have no idea how podman works, but doesn't it need to relabel the inside of a container every time a new one is created?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is both ugly and error prone, and also not even necessary any more with disabling SELinux below. I suggest to simply drop the :Z where it writes the script above, and drop this.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, you want to drop this again at some point when this is fixed, I see.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also not even necessary any more with disabling SELinux below.

It is, unfortunately. podman crashes regardless of whether SELinux is enabled or not.

sed -i 's/enforcing/permissive/' /etc/selinux/config
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FTR, 👍 from me. This has fooled us too many times, and it's completely irrelevant to what we want to test.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, this is meant to be a "temporary" workaround, and hopefully we can just remove these two lines once the fix to #173 has reached us.


podman logs -f freeipa &
LOGS=$!

Expand Down