Wolfi toolbox thread

J

j0rgeOP•6/6/24, 12:59 PM

https://github.com/containers/toolbox/issues/1474

GitHub

Consider adding apk based Image like Wolfi or Alpine · Issue #1474 ...

Both seem to be common choices for containers and currently there is no official image, that uses apk as package manager. Of course this can be done using distrobox, but having a more officially su...

J

j0rgeOP•6/6/24, 1:00 PM

good news, upstream toolbx-images is willing to accept wolfi, IMO we should "move" our wolfi-base there and maintain it there. As luck would have it, timothee maintains the images repo, and I've maintained alpine's images there already

J

j0rgeOP•6/6/24, 1:01 PM

cc @EyeCantCU @89luca89

J

j0rgeOP•6/6/24, 1:02 PM

https://github.com/toolbx-images/images

J

j0rgeOP•6/6/24, 1:02 PM

repo

J

j0rgeOP•6/6/24, 1:02 PM

and here's my alpine section

J

j0rgeOP•6/6/24, 1:02 PM

https://github.com/toolbx-images/images/tree/main/alpine/edge

J

j0rgeOP•6/6/24, 1:02 PM

https://github.com/toolbx-images/images/blob/main/.github/workflows/alpine.yaml

J

j0rgeOP•6/6/24, 1:03 PM

and here's the workflow. It'd be a quick copy and rename job, I'll try to work on it tonight unless someone else gets to it first

M

M2•6/6/24, 1:09 PM

Our wolfi toolbox will now launch in toolbox, but there are two bugs.

1. User is not added to sudoers file.
2. Wolfi doesn't seem to have the xterm terminfo

E

EyeCantCU•6/6/24, 1:10 PM

Happy to help out with this though availability today will be scarce. Got a nightmare of images thrown my way

E

EyeCantCU•6/6/24, 1:10 PM

NeuVector has been... an experience lol

M

M2•6/6/24, 1:11 PM

1. Unsure how toolbox sets sudoers compared to distrobox.
2. The ncurses package simply doesn't have the terminfo. Distrobox mounts in host term info under /usr/local

EEyeCantCU Happy to help out with this though availability today will be scarce. Got a nigh...

J

j0rgeOP•6/6/24, 1:33 PM

My demo to ya'll is on Monday, and even if it's just "we intend to do this" it'll be enough

J

j0rgeOP•6/6/24, 1:34 PM

just knowing that upstream would be receptive to wolfi at all is amazing. We build this, the sysext and a WSL image, and we'll have the Wolfi Subsystem for Linux.

Jj0rge My demo to ya'll is on Monday, and even if it's just "we intend to do this" it'l...

E

EyeCantCU•6/6/24, 1:42 PM

I saw! Can't wait. Definitely awesome that they're receptive. Let's definitely get all this built out. Lol, it'd be funny to call the repo for Wolfi SL WSL...

J

j0rgeOP•6/6/24, 1:43 PM

I am literally going to call it that

J

j0rgeOP•6/6/24, 1:43 PM

WSL is the best undistro for WSL

MM2 1. Unsure how toolbox sets sudoers compared to distrobox. 2. The ncurses packag...

8

89luca89•6/6/24, 1:54 PM

1- no problem now Wolfi has "real" sudo and works well with dbox (and I assume toolbx)
2- this can be a non-issue with dbox but it's an issue with toolbx

8

89luca89•6/6/24, 1:56 PM

btw I'm already using a wolfi container for some time now:

[wolfi_distrobox]
image=cgr.dev/chainguard/wolfi-base:latest
pull=true
init=false
start_now=true
replace=true
# Basic utilities for terminal use
additional_packages="lm-sensors"
additional_packages="gawk parallel perl netcat-openbsd bind-tools net-tools openssl rsync rclone tree curl wget"
# TUI Tools
additional_packages="jq tig tmux vim"
# Development packages
additional_packages="git kubectl kind"
additional_packages="gh clang-extras"
additional_packages="clang py3-codespell gcc shfmt nodejs npm yarn rust rust-analyzer go golangci-lint grype"
# Python
additional_packages="py3-pip"
# Generic
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/docker
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/docker-compose
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/flatpak
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/podman
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/xdg-open
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install github.com/onsi/ginkgo/v2/ginkgo@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install golang.org/x/tools/cmd/goimports@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install golang.org/x/tools/gopls@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install mvdan.cc/gofumpt@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install sigs.k8s.io/kind@latest
init_hooks=pip3 install --break-system-packages python-language-server[all] yamllint

[wolfi_distrobox]
image=cgr.dev/chainguard/wolfi-base:latest
pull=true
init=false
start_now=true
replace=true
# Basic utilities for terminal use
additional_packages="lm-sensors"
additional_packages="gawk parallel perl netcat-openbsd bind-tools net-tools openssl rsync rclone tree curl wget"
# TUI Tools
additional_packages="jq tig tmux vim"
# Development packages
additional_packages="git kubectl kind"
additional_packages="gh clang-extras"
additional_packages="clang py3-codespell gcc shfmt nodejs npm yarn rust rust-analyzer go golangci-lint grype"
# Python
additional_packages="py3-pip"
# Generic
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/docker
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/docker-compose
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/flatpak
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/podman
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/xdg-open
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install github.com/onsi/ginkgo/v2/ginkgo@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install golang.org/x/tools/cmd/goimports@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install golang.org/x/tools/gopls@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install mvdan.cc/gofumpt@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install sigs.k8s.io/kind@latest
init_hooks=pip3 install --break-system-packages python-language-server[all] yamllint

[wolfi_distrobox]
image=cgr.dev/chainguard/wolfi-base:latest
pull=true
init=false
start_now=true
replace=true
# Basic utilities for terminal use
additional_packages="lm-sensors"
additional_packages="gawk parallel perl netcat-openbsd bind-tools net-tools openssl rsync rclone tree curl wget"
# TUI Tools
additional_packages="jq tig tmux vim"
# Development packages
additional_packages="git kubectl kind"
additional_packages="gh clang-extras"
additional_packages="clang py3-codespell gcc shfmt nodejs npm yarn rust rust-analyzer go golangci-lint grype"
# Python
additional_packages="py3-pip"
# Generic
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/docker
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/docker-compose
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/flatpak
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/podman
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/xdg-open
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install github.com/onsi/ginkgo/v2/ginkgo@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install golang.org/x/tools/cmd/goimports@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install golang.org/x/tools/gopls@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install mvdan.cc/gofumpt@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install sigs.k8s.io/kind@latest
init_hooks=pip3 install --break-system-packages python-language-server[all] yamllint

[wolfi_distrobox]
image=cgr.dev/chainguard/wolfi-base:latest
pull=true
init=false
start_now=true
replace=true
# Basic utilities for terminal use
additional_packages="lm-sensors"
additional_packages="gawk parallel perl netcat-openbsd bind-tools net-tools openssl rsync rclone tree curl wget"
# TUI Tools
additional_packages="jq tig tmux vim"
# Development packages
additional_packages="git kubectl kind"
additional_packages="gh clang-extras"
additional_packages="clang py3-codespell gcc shfmt nodejs npm yarn rust rust-analyzer go golangci-lint grype"
# Python
additional_packages="py3-pip"
# Generic
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/docker
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/docker-compose
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/flatpak
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/podman
init_hooks=ln -sf /usr/bin/distrobox-host-exec /usr/local/bin/xdg-open
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install github.com/onsi/ginkgo/v2/ginkgo@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install golang.org/x/tools/cmd/goimports@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install golang.org/x/tools/gopls@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install mvdan.cc/gofumpt@latest
init_hooks=GOPATH="/usr/local/share/system-go" GOBIN=/usr/local/bin go install sigs.k8s.io/kind@latest
init_hooks=pip3 install --break-system-packages python-language-server[all] yamllint

8

89luca89•6/6/24, 1:56 PM

there are some missing packages (mainly utilities like cpupower) and I'd like to NOT use

go install

go install

go install

go install (but these are plans for the future

)

M

M2•6/6/24, 1:56 PM

Yepp real sudo is there. It looks like toolbox un comments the group wheel/sudo and doesn't do that for wolfi

J

j0rgeOP•6/6/24, 1:57 PM

do we think it's good enough as is to PR? I was thinking of getting it in there and then do some subsequent PRs, I found stuff that can be sliced out of ours to submit. We add things for like instant launch in distrobox that probably not go in this base image?

MM2 Yepp real sudo is there. It looks like toolbox un comments the group wheel/sudo ...

8

89luca89•6/6/24, 1:57 PM

yea toolbx acts on /etc/sudoers.conf while dbox does an augmenting conf in /etc/sudoers.conf.d

J

j0rgeOP•6/6/24, 1:57 PM

btw it takes me about 5 minutes every 6 months to maintain the alpine images, and that's only because they release versions, with wolfi it'd be really low mainteance, I can commit to that part

Jj0rge do we think it's good enough as is to PR? I was thinking of getting it in there ...

8

89luca89•6/6/24, 1:57 PM

instant launch is supported for sure, if we add the missing packages

J

j0rgeOP•6/6/24, 1:58 PM

toolbox instant launches right?

M

M2•6/6/24, 1:58 PM

Yepp. Our wolfi-toolbox is instant launch

8

89luca89•6/6/24, 1:58 PM

toolbox always instant launcher, because it already assumes everything is there, and if it doesn't it's a you-problem

J

j0rgeOP•6/6/24, 1:58 PM

hah yeah

M

M2•6/6/24, 1:59 PM

Just missing the 2 items I specified for it to work ootb without warnings

M

M2•6/6/24, 1:59 PM

For distrobox, our image is instant launch

8

89luca89•6/6/24, 2:00 PM

@j0rge I'm going to PR the wolfi images no problem

J

j0rgeOP•6/6/24, 2:00 PM

get that win!

8

89luca89•6/6/24, 2:00 PM

there is only one thing i'd like to highlight

J

j0rgeOP•6/6/24, 2:00 PM

There is no escape, all will follow The Final Shape, even if you use toolbx.

8

89luca89•6/6/24, 2:01 PM

all the -toolbx images do this:

RUN echo "%wheel ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/toolbox

RUN echo "%wheel ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/toolbox

RUN echo "%wheel ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/toolbox

RUN echo "%wheel ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/toolbox

this invalidates the fact that distrobox does NOT enable passwordless sudo on rootful containers, for security reasons

M

M2•6/6/24, 2:04 PM

Interesting, that explains how sudo was being setup.

8

89luca89•6/6/24, 2:05 PM

simple fix is to use /etc/sudoers.d/sudoers which is the file dbox uses, and that is deleted if the user is rootful

M

M2•6/6/24, 2:05 PM

Yeah. Does toolbox even support rootful?

M

M2•6/6/24, 2:06 PM

I'm remember it didn't a while ago and was a distrobox feature point

8

89luca89•6/6/24, 2:07 PM

I think yes, but that is not a security concern with podman

podman is not a daemonful service, with the dedicated group to do rootful things
docker is

so for example, if an user is in the

docker

docker

group and not in

wheel

wheel

wheel

wheel it could work around this by creating a rootful container, and doing

sudo

sudo

in it

instead dbox will respect wheel/sudo of the host system, and will not enable passwordless sudo for rootful container

J

j0rgeOP•6/6/24, 2:16 PM

man dude, a zstd:chunked wolfi ... smaller out of the box to begin with. bai2u multi gig ubuntu containers lol.

8

89luca89•6/6/24, 2:16 PM

localhost/wolfi-toolbox                   latest      de8a8aae537b  3 minutes ago  240 MB

localhost/wolfi-toolbox latest de8a8aae537b 3 minutes ago 240 MB

localhost/wolfi-toolbox                   latest      de8a8aae537b  3 minutes ago  240 MB

localhost/wolfi-toolbox latest de8a8aae537b 3 minutes ago 240 MB

registry.opensuse.org/opensuse/distrobox  latest      049119b2494e  5 days ago     1.56 GB

registry.opensuse.org/opensuse/distrobox latest 049119b2494e 5 days ago 1.56 GB

registry.opensuse.org/opensuse/distrobox  latest      049119b2494e  5 days ago     1.56 GB

registry.opensuse.org/opensuse/distrobox latest 049119b2494e 5 days ago 1.56 GB

not bad

J

j0rgeOP•6/6/24, 2:17 PM

man dude we should push a zstd tag too, even if it's just for testing.

J

j0rgeOP•6/6/24, 2:17 PM

latest

latest

and

latest-zstd

latest-zstd

latest-zstd

latest-zstd or something

J

j0rgeOP•6/6/24, 2:18 PM

then we'd be able to science the bandwidth savings asd they optimize it upstream, which they are working on actively

8

89luca89•6/6/24, 2:18 PM

altho, it is missing a single package

pinentry

pinentry

pinentry

pinentry that would allow not only instant-entry, but also offline entry
right now it will do an apk-search for it, even if it fails and skips it

J

j0rgeOP•6/6/24, 2:18 PM

antheas found a bunch of issues and reported them and they're already fixing them, this could be awesome.

Jj0rge man dude we should push a zstd tag too, even if it's just for testing.

8

89luca89•6/6/24, 2:19 PM

can you send me some info about? so I can check

Similar Threads

Similar Threads

Similar Threads