When proper support for handling the OCI layers is implemented in whatever package, wouldn't you wan

When proper support for handling the OCI layers is implemented in whatever package, wouldn't you want to have multiple layers so you're only pulling the changed layers, rather than everything?

E.g. pulling the 20MB for that added package rather than all 3GB of the image each day

RRobert When proper support for handling the OCI layers is implemented in whatever packa...

Kyle Gospo•7/28/23, 7:07 AM

there an issue for this?

Kyle Gospo•7/28/23, 7:07 AM

much prefer that

Gerblesh•7/28/23, 7:18 AM

I'd check out bootc

Gerblesh•7/28/23, 7:18 AM

Idk if they will do it there but that's the future of ostree native containers

RobertOP•7/28/23, 7:18 AM

The closest I could find:
https://github.com/coreos/rpm-ostree/issues/4012

But I think it's already partially implemented already.
If you add a new package now in a RUN statement at the end of the Containerfile and run

rpm-ostree update

rpm-ostree update

, you will have a single small chunk/layer to download.

If you bundled all package installs together, you will have to download the entire layer/chunk containing not only your change, but all other packages installed in that layer.

I seem to remember there was some talk about how to handle this better since daily updates (updates in the base image) require the full 3gb or so to be downloaded

GitHub

`container-encapsulate` should be more intelligent · Issue #4012 · ...

Today, the algorithm backing rpm-ostree compose container-encapsulate (and rpm-ostree compose image) is pretty simplistic. It basically tries to stick the largest RPMs in layers, and then "spi...

Kyle Gospo•7/28/23, 7:19 AM

yeah, right now most updates are 1.5GB which is just massive for the changes being made

Kyle Gospo•7/28/23, 7:19 AM

that's with it split up though

RobertOP•7/28/23, 7:20 AM

I guess that's after the daily rebuilds? Where the base is changed and therefore all subsequent steps have changed - meaning you must download all layers after the changed bit.

I thought there was an issue somewhere about how to prevent this upstream, but couldn't find it

RobertOP•7/28/23, 7:27 AM

I might be wrong with all of this. I'm going off best practices for building images for K8s, which is quite different to what we're doing with bootc or whatever.

jpeeler•7/28/23, 2:25 PM

@Gerblesh did you ever figure anything else more about this selinux issue? https://github.com/ublue-os/main/issues/223 i bothered two incorrect upstreams, so i appreciate you filing the issue

GitHub

greetd + SELinux issues · Issue #223 · ublue-os/main

this issue is detailing the repeated problems we had with greetd and SELinux in the discord, don't know if this will ever be solved or if it can be solved but it's good to have it as an iss...

Jjpeeler @Gerblesh did you ever figure anything else more about this selinux issue? https...

Gerblesh•7/28/23, 2:34 PM

Not really

akdev•7/28/23, 2:35 PM

The last error message in that issue can probably be worked around by specifiying the full selinux label the file should have

akdev•7/28/23, 2:35 PM

This is probably a bug in rpm-ostree ultimately because the rpm package has the correct things set

Gerblesh•7/28/23, 2:36 PM

It works when layering in a booted image

Gerblesh•7/28/23, 2:36 PM

But not when layering in the image

jpeeler•7/28/23, 2:36 PM

i feel like i layered it initially and still had a problem, perhaps i'm misremembering

jpeeler•7/28/23, 2:40 PM

also tuigreet package maintainer said it wasn't a problem on his Sericea system, so that makes me think it's not an rpm-ostree issue

akdev•7/28/23, 2:42 PM

We should try having a minimum verified compilable/runnable example

akdev•7/28/23, 2:42 PM

if we do like:

FROM fedora-ostree-upstream:latest

RUN rpm-ostree install -y greeted

FROM fedora-ostree-upstream:latest

RUN rpm-ostree install -y greeted

akdev•7/28/23, 2:43 PM

Does it have the right label or not?

akdev•7/28/23, 2:43 PM

If we do

rpm-ostree install -y greetd

rpm-ostree install -y greetd

does it work ok or not?

j0rge•7/28/23, 3:01 PM

https://github.com/ublue-os/config/pull/86 can someone take a look? this seems fine to me

Aakdev if we do like: ``` FROM fedora-ostree-upstream:latest RUN rpm-ostree install -...

jpeeler•7/28/23, 3:07 PM

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

FROM quay.io/fedora/fedora-silverblue:39
RUN rpm-ostree install -y greetd
RUN ls -lZ /usr/bin/greetd

yields system_u:object_r:container_file_t:s0:c119,c174. seems wrong, but i don't know what i'm talking about on this.

akdev•7/28/23, 3:08 PM

It is wrong indeed

akdev•7/28/23, 3:08 PM

container_file_t is the default label for files created by a container

akdev•7/28/23, 3:09 PM

If you see here: https://src.fedoraproject.org/rpms/greetd/blob/f35/f/greetd.fc#_4

akdev•7/28/23, 3:09 PM

system_u:object_r:xdm_exec_t,s0

Sofie•7/28/23, 3:10 PM

hey? when updating my distrobox fedora 39 container it says: Unpack error: shadow-utils-2:4.13-8.fc39.x86_64 and in the logs its cpio: cap_set_file failed - No data available

Aakdev If you see here: https://src.fedoraproject.org/rpms/greetd/blob/f35/f/greetd.fc#...

jpeeler•7/28/23, 3:13 PM

right, well i suppose we have our reproducer then

akdev•7/28/23, 3:14 PM

Could you try

rpm -E '%{with selinux}'

rpm -E '%{with selinux}'

inside the container?

akdev•7/28/23, 3:14 PM

I’m looking at different ways that this could be skipped

akdev•7/28/23, 3:15 PM

If that commands prints 0 then that could be the reason

jpeeler•7/28/23, 3:19 PM

it does print 0

akdev•7/28/23, 3:20 PM

Could you try on your fedora system? It should print 1

akdev•7/28/23, 3:21 PM

If this prints 0 the package will skip selinux labeling

Sofie•7/28/23, 3:21 PM

is this like official https://marketplace.visualstudio.com/items?itemName=skellock.just

just - Visual Studio Marketplace

Extension for Visual Studio Code - Provides syntax and recipe launcher for Just scripts.

Sofie•7/28/23, 3:21 PM

probably not

Sofie•7/28/23, 3:22 PM

just looking for extensions for just

Aakdev Could you try on your fedora system? It should print 1

akdev•7/28/23, 3:32 PM

Mm prints 0 on my fedora system (outside the container too)

jpeeler•7/28/23, 3:42 PM

sestatus reports disabled, though i'm not sure selinux has to be reported as enabled to have proper file labeling

akdev•7/28/23, 3:44 PM

It does, sort of - but the report can inaccurate from within a container

akdev•7/28/23, 3:44 PM

The kernel actually needs to have selinux enabled at least in permissive mode or it won’t do any file labeling

akdev•7/28/23, 3:45 PM

Within a container the report may be inaccurate due to lack of permissions, even if the underlying kernel has selinux enabled it can report disabled

Jj0rge <https://github.com/ublue-os/config/pull/86> can someone take a look? this seems...

bsherman•7/28/23, 3:45 PM

i replied... i do have mild concern... mostly that it's not adding clear value and could add confusion.

akdev•7/28/23, 4:19 PM

getenforce

getenforce

and

sestatus

sestatus

just straight up lie in a container context

akdev•7/28/23, 4:21 PM

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

int main() {
    printf("getenforce: %d\n", security_getenforce());
    return 0;
}
[root@7f48d3df7bc2 libselinux]# ./a.out
getenforce: 1
[root@7f48d3df7bc2 libselinux]# getenforce
Disabled

akdev•7/28/23, 4:31 PM

ah,

libselinux

libselinux

is looking for two things:

/sys/fs/selinux

/sys/fs/selinux

needs to be mounted and

/etc/selinux/config

/etc/selinux/config

also needs to be mounted

akdev•7/28/23, 4:34 PM

but even after this:

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd
-rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May  3 15:52 /usr/bin/greetd
[root@88ee797ef4cc selinux]# getenforce
Enforcing

akdev•7/28/23, 4:34 PM

the bug is actually reproducible on regular fedora container

akdev•7/28/23, 4:46 PM

and it is also reproducible by installing gdm

[root@88ee797ef4cc selinux]# ls -lZ /usr/bin/greetd -rwxr-xr-x. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 843576 May 3 15:52 /usr/bin/greetd [root@88ee797ef4cc selinux]# getenforce Enforcing

When proper support for handling the OCI layers is implemented in whatever package, wouldn't you wan

Similar Threads

Similar Threads

Similar Threads