Before (Saving this for when I can get an after)

KKyle Gospo Before (Saving this for when I can get an after)

K

Kyle GospoOP•7/28/23, 4:16 AM

Layers data for this

message.txt16.93KB

R

Robert•7/28/23, 7:06 AM

When proper support for handling the OCI layers is implemented in whatever package, wouldn't you want to have multiple layers so you're only pulling the changed layers, rather than everything?

E.g. pulling the 20MB for that added package rather than all 3GB of the image each day

RRobert When proper support for handling the OCI layers is implemented in whatever packa...

K

Kyle GospoOP•7/28/23, 7:07 AM

there an issue for this?

K

Kyle GospoOP•7/28/23, 7:07 AM

much prefer that

G

Gerblesh•7/28/23, 7:18 AM

I'd check out bootc

G

Gerblesh•7/28/23, 7:18 AM

Idk if they will do it there but that's the future of ostree native containers

R

Robert•7/28/23, 7:18 AM

The closest I could find:
https://github.com/coreos/rpm-ostree/issues/4012

But I think it's already partially implemented already.
If you add a new package now in a RUN statement at the end of the Containerfile and run

rpm-ostree update

rpm-ostree update

, you will have a single small chunk/layer to download.

If you bundled all package installs together, you will have to download the entire layer/chunk containing not only your change, but all other packages installed in that layer.

I seem to remember there was some talk about how to handle this better since daily updates (updates in the base image) require the full 3gb or so to be downloaded

GitHub

`container-encapsulate` should be more intelligent · Issue #4012 · ...

Today, the algorithm backing rpm-ostree compose container-encapsulate (and rpm-ostree compose image) is pretty simplistic. It basically tries to stick the largest RPMs in layers, and then "spi...

K

Kyle GospoOP•7/28/23, 7:19 AM

yeah, right now most updates are 1.5GB which is just massive for the changes being made

K

Kyle GospoOP•7/28/23, 7:19 AM

that's with it split up though

R

Robert•7/28/23, 7:20 AM

I guess that's after the daily rebuilds? Where the base is changed and therefore all subsequent steps have changed - meaning you must download all layers after the changed bit.

I thought there was an issue somewhere about how to prevent this upstream, but couldn't find it

R

Robert•7/28/23, 7:27 AM

I might be wrong with all of this. I'm going off best practices for building images for K8s, which is quite different to what we're doing with bootc or whatever.

J

jpeeler•7/28/23, 2:25 PM

@Gerblesh did you ever figure anything else more about this selinux issue? https://github.com/ublue-os/main/issues/223 i bothered two incorrect upstreams, so i appreciate you filing the issue

GitHub

greetd + SELinux issues · Issue #223 · ublue-os/main

this issue is detailing the repeated problems we had with greetd and SELinux in the discord, don't know if this will ever be solved or if it can be solved but it's good to have it as an iss...

Jjpeeler @Gerblesh did you ever figure anything else more about this selinux issue? https...

G

Gerblesh•7/28/23, 2:34 PM

Not really

A

akdev•7/28/23, 2:35 PM

The last error message in that issue can probably be worked around by specifiying the full selinux label the file should have

A

akdev•7/28/23, 2:35 PM

This is probably a bug in rpm-ostree ultimately because the rpm package has the correct things set

G

Gerblesh•7/28/23, 2:36 PM

It works when layering in a booted image

G

Gerblesh•7/28/23, 2:36 PM

But not when layering in the image

J

jpeeler•7/28/23, 2:36 PM

i feel like i layered it initially and still had a problem, perhaps i'm misremembering

J

jpeeler•7/28/23, 2:40 PM

also tuigreet package maintainer said it wasn't a problem on his Sericea system, so that makes me think it's not an rpm-ostree issue

A

akdev•7/28/23, 2:42 PM

We should try having a minimum verified compilable/runnable example

A

akdev•7/28/23, 2:42 PM

if we do like:

FROM fedora-ostree-upstream:latest

RUN rpm-ostree install -y greeted

FROM fedora-ostree-upstream:latest

RUN rpm-ostree install -y greeted

A

akdev•7/28/23, 2:43 PM

Does it have the right label or not?

A

akdev•7/28/23, 2:43 PM

If we do

rpm-ostree install -y greetd

rpm-ostree install -y greetd

does it work ok or not?

J

j0rge•7/28/23, 3:01 PM

https://github.com/ublue-os/config/pull/86 can someone take a look? this seems fine to me

Aakdev if we do like: ``` FROM fedora-ostree-upstream:latest RUN rpm-ostree install -...

J

jpeeler•7/28/23, 3:07 PM

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

yields system_u:object_r:container_file_t:s0:c119,c174. seems wrong, but i don't know what i'm talking about on this.

A

akdev•7/28/23, 3:08 PM

It is wrong indeed

A

akdev•7/28/23, 3:08 PM

container_file_t is the default label for files created by a container

A

akdev•7/28/23, 3:09 PM

If you see here: https://src.fedoraproject.org/rpms/greetd/blob/f35/f/greetd.fc#_4

A

akdev•7/28/23, 3:09 PM

system_u:object_r:xdm_exec_t,s0

S

Sofie•7/28/23, 3:10 PM

hey? when updating my distrobox fedora 39 container it says: Unpack error: shadow-utils-2:4.13-8.fc39.x86_64 and in the logs its cpio: cap_set_file failed - No data available

Aakdev If you see here: https://src.fedoraproject.org/rpms/greetd/blob/f35/f/greetd.fc#...

J

jpeeler•7/28/23, 3:13 PM

right, well i suppose we have our reproducer then

A

akdev•7/28/23, 3:14 PM

Could you try

rpm -E '%{with selinux}'

rpm -E '%{with selinux}'

inside the container?

A

akdev•7/28/23, 3:14 PM

I’m looking at different ways that this could be skipped

A

akdev•7/28/23, 3:15 PM

If that commands prints 0 then that could be the reason

J

jpeeler•7/28/23, 3:19 PM

it does print 0

A

akdev•7/28/23, 3:20 PM

Could you try on your fedora system? It should print 1

A

akdev•7/28/23, 3:21 PM

If this prints 0 the package will skip selinux labeling

S

Sofie•7/28/23, 3:21 PM

is this like official https://marketplace.visualstudio.com/items?itemName=skellock.just

just - Visual Studio Marketplace

Extension for Visual Studio Code - Provides syntax and recipe launcher for Just scripts.

S

Sofie•7/28/23, 3:21 PM

probably not

S

Sofie•7/28/23, 3:22 PM

just looking for extensions for just

Aakdev Could you try on your fedora system? It should print 1

A

akdev•7/28/23, 3:32 PM

Mm prints 0 on my fedora system (outside the container too)

J

jpeeler•7/28/23, 3:42 PM

sestatus reports disabled, though i'm not sure selinux has to be reported as enabled to have proper file labeling

A

akdev•7/28/23, 3:44 PM

It does, sort of - but the report can inaccurate from within a container

A

akdev•7/28/23, 3:44 PM

The kernel actually needs to have selinux enabled at least in permissive mode or it won’t do any file labeling

A

akdev•7/28/23, 3:45 PM

Within a container the report may be inaccurate due to lack of permissions, even if the underlying kernel has selinux enabled it can report disabled

Jj0rge <https://github.com/ublue-os/config/pull/86> can someone take a look? this seems...

B

bsherman•7/28/23, 3:45 PM

i replied... i do have mild concern... mostly that it's not adding clear value and could add confusion.

A

akdev•7/28/23, 4:19 PM

mm

getenforce

getenforce

getenforce

getenforce and

sestatus

sestatus

sestatus

sestatus just straight up lie in a container context

A

akdev•7/28/23, 4:21 PM

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

A

akdev•7/28/23, 4:31 PM

ah,

libselinux

libselinux

libselinux

libselinux is looking for two things:

/sys/fs/selinux

/sys/fs/selinux

/sys/fs/selinux

/sys/fs/selinux needs to be mounted and

/etc/selinux/config

/etc/selinux/config

/etc/selinux/config

/etc/selinux/config also needs to be mounted

A

akdev•7/28/23, 4:34 PM

but even after this:

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

Before (Saving this for when I can get an after)

Similar Threads

Similar Threads

Similar Threads