it seems to work if I pass `/run/dbus/system_bus_socket` into the container, although I had to creat

it seems to work if I pass

/run/dbus/system_bus_socket

/run/dbus/system_bus_socket

/run/dbus/system_bus_socket

/run/dbus/system_bus_socket into the container, although I had to create

/etc/dbus-1/system.d/com.system76.Scheduler.conf

/etc/dbus-1/system.d/com.system76.Scheduler.conf

/etc/dbus-1/system.d/com.system76.Scheduler.conf

/etc/dbus-1/system.d/com.system76.Scheduler.conf on the host first

Xxkrith it seems to work if I pass `/run/dbus/system_bus_socket` into the container, alt...

Kyle Gospo•7/27/23, 7:28 PM

very nice

Xxkrith it seems to work if I pass `/run/dbus/system_bus_socket` into the container, alt...

bsherman•7/27/23, 8:04 PM

that's pretty cool

Kyle Gospo•7/28/23, 4:04 AM

https://github.com/ublue-os/bazzite/pull/83

GitHub

Optimize Containerfile by KyleGospo · Pull Request #83 · ublue-os/b...

Reduce the amount of layers by keeping RUN and COPY to a minimum

Kyle Gospo•7/28/23, 4:04 AM

would love some extra eyes on this, big change from how we were doing things and I'm only going off what I've read so far regarding layer count & size

j0rge•7/28/23, 4:06 AM

I don't know enough to know other than I am very interested in the resulting difference

Kyle Gospo•7/28/23, 4:15 AM

Before (Saving this for when I can get an after)

message.txt5.45KB

KKyle Gospo Before (Saving this for when I can get an after)

Kyle Gospo•7/28/23, 4:16 AM

Layers data for this

message.txt16.93KB

Robert•7/28/23, 7:06 AM

When proper support for handling the OCI layers is implemented in whatever package, wouldn't you want to have multiple layers so you're only pulling the changed layers, rather than everything?

E.g. pulling the 20MB for that added package rather than all 3GB of the image each day

RRobert When proper support for handling the OCI layers is implemented in whatever packa...

Kyle Gospo•7/28/23, 7:07 AM

there an issue for this?

Kyle Gospo•7/28/23, 7:07 AM

much prefer that

Gerblesh•7/28/23, 7:18 AM

I'd check out bootc

Gerblesh•7/28/23, 7:18 AM

Idk if they will do it there but that's the future of ostree native containers

Robert•7/28/23, 7:18 AM

The closest I could find:
https://github.com/coreos/rpm-ostree/issues/4012

But I think it's already partially implemented already.
If you add a new package now in a RUN statement at the end of the Containerfile and run

rpm-ostree update

rpm-ostree update

, you will have a single small chunk/layer to download.

If you bundled all package installs together, you will have to download the entire layer/chunk containing not only your change, but all other packages installed in that layer.

I seem to remember there was some talk about how to handle this better since daily updates (updates in the base image) require the full 3gb or so to be downloaded

GitHub

`container-encapsulate` should be more intelligent · Issue #4012 · ...

Today, the algorithm backing rpm-ostree compose container-encapsulate (and rpm-ostree compose image) is pretty simplistic. It basically tries to stick the largest RPMs in layers, and then "spi...

Kyle Gospo•7/28/23, 7:19 AM

yeah, right now most updates are 1.5GB which is just massive for the changes being made

Kyle Gospo•7/28/23, 7:19 AM

that's with it split up though

Robert•7/28/23, 7:20 AM

I guess that's after the daily rebuilds? Where the base is changed and therefore all subsequent steps have changed - meaning you must download all layers after the changed bit.

I thought there was an issue somewhere about how to prevent this upstream, but couldn't find it

Robert•7/28/23, 7:27 AM

I might be wrong with all of this. I'm going off best practices for building images for K8s, which is quite different to what we're doing with bootc or whatever.

jpeeler•7/28/23, 2:25 PM

@Gerblesh did you ever figure anything else more about this selinux issue? https://github.com/ublue-os/main/issues/223 i bothered two incorrect upstreams, so i appreciate you filing the issue

GitHub

greetd + SELinux issues · Issue #223 · ublue-os/main

this issue is detailing the repeated problems we had with greetd and SELinux in the discord, don't know if this will ever be solved or if it can be solved but it's good to have it as an iss...

Jjpeeler @Gerblesh did you ever figure anything else more about this selinux issue? https...

Gerblesh•7/28/23, 2:34 PM

Not really

akdev•7/28/23, 2:35 PM

The last error message in that issue can probably be worked around by specifiying the full selinux label the file should have

akdev•7/28/23, 2:35 PM

This is probably a bug in rpm-ostree ultimately because the rpm package has the correct things set

Gerblesh•7/28/23, 2:36 PM

It works when layering in a booted image

Gerblesh•7/28/23, 2:36 PM

But not when layering in the image

jpeeler•7/28/23, 2:36 PM

i feel like i layered it initially and still had a problem, perhaps i'm misremembering

jpeeler•7/28/23, 2:40 PM

also tuigreet package maintainer said it wasn't a problem on his Sericea system, so that makes me think it's not an rpm-ostree issue

akdev•7/28/23, 2:42 PM

We should try having a minimum verified compilable/runnable example

akdev•7/28/23, 2:42 PM

if we do like:

FROM fedora-ostree-upstream:latest

RUN rpm-ostree install -y greeted

FROM fedora-ostree-upstream:latest

RUN rpm-ostree install -y greeted

akdev•7/28/23, 2:43 PM

Does it have the right label or not?

akdev•7/28/23, 2:43 PM

If we do

rpm-ostree install -y greetd

rpm-ostree install -y greetd

does it work ok or not?

j0rge•7/28/23, 3:01 PM

https://github.com/ublue-os/config/pull/86 can someone take a look? this seems fine to me

Aakdev if we do like: ``` FROM fedora-ostree-upstream:latest RUN rpm-ostree install -...

jpeeler•7/28/23, 3:07 PM

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

yields system_u:object_r:container_file_t:s0:c119,c174. seems wrong, but i don't know what i'm talking about on this.

akdev•7/28/23, 3:08 PM

It is wrong indeed

akdev•7/28/23, 3:08 PM

container_file_t is the default label for files created by a container

akdev•7/28/23, 3:09 PM

If you see here: https://src.fedoraproject.org/rpms/greetd/blob/f35/f/greetd.fc#_4

akdev•7/28/23, 3:09 PM

system_u:object_r:xdm_exec_t,s0

Sofie•7/28/23, 3:10 PM

hey? when updating my distrobox fedora 39 container it says: Unpack error: shadow-utils-2:4.13-8.fc39.x86_64 and in the logs its cpio: cap_set_file failed - No data available

Aakdev If you see here: https://src.fedoraproject.org/rpms/greetd/blob/f35/f/greetd.fc#...

jpeeler•7/28/23, 3:13 PM

right, well i suppose we have our reproducer then

akdev•7/28/23, 3:14 PM

Could you try

rpm -E '%{with selinux}'

rpm -E '%{with selinux}'

inside the container?

akdev•7/28/23, 3:14 PM

I’m looking at different ways that this could be skipped

akdev•7/28/23, 3:15 PM

If that commands prints 0 then that could be the reason

jpeeler•7/28/23, 3:19 PM

it does print 0

akdev•7/28/23, 3:20 PM

Could you try on your fedora system? It should print 1

akdev•7/28/23, 3:21 PM

If this prints 0 the package will skip selinux labeling

Sofie•7/28/23, 3:21 PM

is this like official https://marketplace.visualstudio.com/items?itemName=skellock.just

just - Visual Studio Marketplace

Extension for Visual Studio Code - Provides syntax and recipe launcher for Just scripts.

Sofie•7/28/23, 3:21 PM

probably not

Sofie•7/28/23, 3:22 PM

just looking for extensions for just

Aakdev Could you try on your fedora system? It should print 1

akdev•7/28/23, 3:32 PM

Mm prints 0 on my fedora system (outside the container too)

jpeeler•7/28/23, 3:42 PM

sestatus reports disabled, though i'm not sure selinux has to be reported as enabled to have proper file labeling

akdev•7/28/23, 3:44 PM

It does, sort of - but the report can inaccurate from within a container

akdev•7/28/23, 3:44 PM

The kernel actually needs to have selinux enabled at least in permissive mode or it won’t do any file labeling

it seems to work if I pass `/run/dbus/system_bus_socket` into the container, although I had to creat

Similar Threads

Similar Threads

Similar Threads