disable systemd-binfmt.service #3511
Conversation
k8s-ci-robot
added
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: BenTheElder The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
approved
BenTheElder
changed the title
| && systemctl enable kubelet.service \ | ||
| && systemctl enable containerd.service \ | ||
| && systemctl enable undo-mount-hacks.service | ||
| && systemctl enable undo-mount-hacks.service \ | ||
| && systemctl mask systemd-binfmt.service |
There was a problem hiding this comment.
it seems something happened with this in bookworm, a quick search on google show several hits microsoft/WSL#8843
AFAIK this reads from a folder, can we have any side effect of doing this hammer approach or should we try to be more precise and understand what is exactly breaking this?
There was a problem hiding this comment.
oh, I see, it screws the list entirely #3510
There was a problem hiding this comment.
I imagine then that the best way is to say the docker container must use the one existing in the host
/lgtm
There was a problem hiding this comment.
so often binfmt_misc is intentionally set by containers (see e.g. our multi-arch build setup), but kind nodes shouldn't be doing it, and python scripts should keep using shebangs and not depend on this anyhow ...
There was a problem hiding this comment.
Per https://systemd.io/CONTAINER_INTERFACE/ (execution environment number 2) /proc/sys being a read-only mount is the recommended way to tell systemd not to change things. However as that mentions also making /proc/sys/net writable may be desirable (and likely would be needed for many k8s workloads).
It likely needs more thought than will fit in a review comment, so this targeted workaround makes sense for now.
There was a problem hiding this comment.
Yeah, the base image comments link to this page -- We have other similar workarounds for similar reasons, we're really stretching "systemd in a container" when we go --privileged but without it we can't get the "kubernetes 'in' a container" part. Previously in practice the key part was /sys mounted ro (mentioned further down as a trigger for udev) which we do.
k8s-ci-robot
added
the
lgtm
BenTheElder
changed the title
k8s-ci-robot
removed
the
do-not-merge/work-in-progress
related to #3510