Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
build.sh: allow the builder user to run rootless podman
We do *some* podman operations inside the COSA container. If running locally as the `builder` user podman will barf when trying to run newuidmap if we don't change up the subuid/subgid mappings. With this change we'll be able to test in our local rootless podman COSA container that `cosa push-container-manifest` works. In order to figure out this worked (at least for what limited podman manifest commands I'm running) I first followed the issue at [1] and realized I had success with the `quay.io/podman/stable` image and then looked inside the image to see what the mapping was. I then lifted the mapping from there [2] and applied it here and it works. Note that inside the pipeline right now (in OpenShift) we still run as a random user but that seems to still be working OK for us for pushing the manifest because it can't find the random UID/GID in /etc/{subuid,subgid} so it falls back to "rootless single mapping into the namespace". [1] containers/podman#4056 (comment) [2] https://github.com/containers/podman/blob/6e382d9ec2e6eb79a72537544341e496368b6c63/contrib/podmanimage/stable/Containerfile#L25-L26
- Loading branch information