Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

enable loopback adapter in hermetic unshare namespace #1469

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
+112 −48
Open

enable loopback adapter in hermetic unshare namespace #1469

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ac8e6b5
enable loopback adapter in hermetic unshare namespace
brianwcook Sep 28, 2024
1257ac8
Merge branch 'main' into bazel
brianwcook Oct 11, 2024
1ab07c2
Merge branch 'main' into bazel
brianwcook Oct 11, 2024
099f0d6
add comment to explain whiy loopback adapter is enabled
brianwcook Oct 12, 2024
39b9be6
Merge branch 'main' into bazel
arewm Oct 16, 2024
acc3be4
regenerate tasks
brianwcook Oct 16, 2024
c62d953
only try to enable loopback in hermetic mode
brianwcook Oct 19, 2024
2c21fb5
Merge branch 'main' into bazel
brianwcook Oct 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 28 additions & 12 deletions task/buildah-oci-ta/0.2/buildah-oci-ta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,10 +350,12 @@ spec:
)

BUILDAH_ARGS=()
UNSHARE_ARGS=()

if [ "${HERMETIC}" == "true" ]; then
BUILDAH_ARGS+=("--pull=never")
UNSHARE_ARGS="--net"
UNSHARE_ARGS+=("--net")

for image in $BASE_IMAGES; do
unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -- buildah pull $image
done
Expand All @@ -378,10 +380,12 @@ spec:
BUILDAH_ARGS+=("--skip-unused-stages=false")
fi

VOLUME_MOUNTS=()

if [ -f "/var/workdir/cachi2/cachi2.env" ]; then
cp -r "/var/workdir/cachi2" /tmp/
chmod -R go+rwX /tmp/cachi2
VOLUME_MOUNTS="--volume /tmp/cachi2:/cachi2"
VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)
# Read in the whole file (https://unix.stackexchange.com/questions/533277), then
# for each RUN ... line insert the cachi2.env command *after* any options like --mount
sed -E -i \
Expand All @@ -408,7 +412,7 @@ spec:
if [ -d "${YUM_REPOS_D_FETCHED}" ]; then
chmod -R go+rwX ${YUM_REPOS_D_FETCHED}
mount_point=$(realpath ${YUM_REPOS_D_FETCHED})
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume ${mount_point}:${YUM_REPOS_D_TARGET}"
VOLUME_MOUNTS+=(--volume "${mount_point}:${YUM_REPOS_D_TARGET}")
fi

DEFAULT_LABELS=(
Expand All @@ -432,12 +436,12 @@ spec:
if [ -e /activation-key/org ]; then
cp -r --preserve=mode "$ACTIVATION_KEY_PATH" /tmp/activation-key
mkdir /shared/rhsm-tmp
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z"
VOLUME_MOUNTS+=(--volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z)
echo "Adding activation key to the build"

elif find /entitlement -name "*.pem" >>null; then
cp -r --preserve=mode "$ENTITLEMENT_PATH" /tmp/entitlement
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume /tmp/entitlement:/etc/pki/entitlement"
VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)
echo "Adding the entitlement to the build"
fi

Expand All @@ -454,13 +458,25 @@ spec:
# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.
declare IMAGE

unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w ${SOURCE_CODE_DIR}/$CONTEXT -- buildah build \
$VOLUME_MOUNTS \
"${BUILDAH_ARGS[@]}" \
"${LABELS[@]}" \
--tls-verify=$TLSVERIFY --no-cache \
--ulimit nofile=4096:4096 \
-f "$dockerfile_copy" -t "$IMAGE" .
buildah_cmd_array=(
buildah build
"${VOLUME_MOUNTS[@]}"
"${BUILDAH_ARGS[@]}"
"${LABELS[@]}"
--tls-verify="$TLSVERIFY" --no-cache
--ulimit nofile=4096:4096
-f "$dockerfile_path" -t "$IMAGE" .
)
buildah_cmd=$(printf "%q " "${buildah_cmd_array[@]}")

if [ "${HERMETIC}" == "true" ]; then
# enabling loopback adapter enables Bazel builds to work in hermetic mode.
command="ip link set lo up && $buildah_cmd"
else
command="$buildah_cmd"
fi

unshare -Uf "${UNSHARE_ARGS[@]}" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w "${SOURCE_CODE_DIR}/$CONTEXT" -- sh -c "$command"

container=$(buildah from --pull-never "$IMAGE")
buildah mount $container | tee /shared/container_path
Expand Down
40 changes: 28 additions & 12 deletions task/buildah-remote-oci-ta/0.2/buildah-remote-oci-ta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -384,10 +384,12 @@ spec:
)

BUILDAH_ARGS=()
UNSHARE_ARGS=()

if [ "${HERMETIC}" == "true" ]; then
BUILDAH_ARGS+=("--pull=never")
UNSHARE_ARGS="--net"
UNSHARE_ARGS+=("--net")

for image in $BASE_IMAGES; do
unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -- buildah pull $image
done
Expand All @@ -412,10 +414,12 @@ spec:
BUILDAH_ARGS+=("--skip-unused-stages=false")
fi

VOLUME_MOUNTS=()

if [ -f "/var/workdir/cachi2/cachi2.env" ]; then
cp -r "/var/workdir/cachi2" /tmp/
chmod -R go+rwX /tmp/cachi2
VOLUME_MOUNTS="--volume /tmp/cachi2:/cachi2"
VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)
# Read in the whole file (https://unix.stackexchange.com/questions/533277), then
# for each RUN ... line insert the cachi2.env command *after* any options like --mount
sed -E -i \
Expand All @@ -442,7 +446,7 @@ spec:
if [ -d "${YUM_REPOS_D_FETCHED}" ]; then
chmod -R go+rwX ${YUM_REPOS_D_FETCHED}
mount_point=$(realpath ${YUM_REPOS_D_FETCHED})
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume ${mount_point}:${YUM_REPOS_D_TARGET}"
VOLUME_MOUNTS+=(--volume "${mount_point}:${YUM_REPOS_D_TARGET}")
fi

DEFAULT_LABELS=(
Expand All @@ -466,12 +470,12 @@ spec:
if [ -e /activation-key/org ]; then
cp -r --preserve=mode "$ACTIVATION_KEY_PATH" /tmp/activation-key
mkdir /shared/rhsm-tmp
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z"
VOLUME_MOUNTS+=(--volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z)
echo "Adding activation key to the build"

elif find /entitlement -name "*.pem" >>null; then
cp -r --preserve=mode "$ENTITLEMENT_PATH" /tmp/entitlement
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume /tmp/entitlement:/etc/pki/entitlement"
VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)
echo "Adding the entitlement to the build"
fi

Expand All @@ -488,13 +492,25 @@ spec:
# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.
declare IMAGE

unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w ${SOURCE_CODE_DIR}/$CONTEXT -- buildah build \
$VOLUME_MOUNTS \
"${BUILDAH_ARGS[@]}" \
"${LABELS[@]}" \
--tls-verify=$TLSVERIFY --no-cache \
--ulimit nofile=4096:4096 \
-f "$dockerfile_copy" -t "$IMAGE" .
buildah_cmd_array=(
buildah build
"${VOLUME_MOUNTS[@]}"
"${BUILDAH_ARGS[@]}"
"${LABELS[@]}"
--tls-verify="$TLSVERIFY" --no-cache
--ulimit nofile=4096:4096
-f "$dockerfile_path" -t "$IMAGE" .
)
buildah_cmd=$(printf "%q " "${buildah_cmd_array[@]}")

if [ "${HERMETIC}" == "true" ]; then
# enabling loopback adapter enables Bazel builds to work in hermetic mode.
command="ip link set lo up && $buildah_cmd"
else
command="$buildah_cmd"
fi

unshare -Uf "${UNSHARE_ARGS[@]}" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w "${SOURCE_CODE_DIR}/$CONTEXT" -- sh -c "$command"

container=$(buildah from --pull-never "$IMAGE")
buildah mount $container | tee /shared/container_path
Expand Down
40 changes: 28 additions & 12 deletions task/buildah-remote/0.2/buildah-remote.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,10 +360,12 @@ spec:
)

BUILDAH_ARGS=()
UNSHARE_ARGS=()

if [ "${HERMETIC}" == "true" ]; then
BUILDAH_ARGS+=("--pull=never")
UNSHARE_ARGS="--net"
UNSHARE_ARGS+=("--net")

for image in $BASE_IMAGES; do
unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -- buildah pull $image
done
Expand All @@ -388,10 +390,12 @@ spec:
BUILDAH_ARGS+=("--skip-unused-stages=false")
fi

VOLUME_MOUNTS=()

if [ -f "$(workspaces.source.path)/cachi2/cachi2.env" ]; then
cp -r "$(workspaces.source.path)/cachi2" /tmp/
chmod -R go+rwX /tmp/cachi2
VOLUME_MOUNTS="--volume /tmp/cachi2:/cachi2"
VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)
# Read in the whole file (https://unix.stackexchange.com/questions/533277), then
# for each RUN ... line insert the cachi2.env command *after* any options like --mount
sed -E -i \
Expand All @@ -418,7 +422,7 @@ spec:
if [ -d "${YUM_REPOS_D_FETCHED}" ]; then
chmod -R go+rwX ${YUM_REPOS_D_FETCHED}
mount_point=$(realpath ${YUM_REPOS_D_FETCHED})
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume ${mount_point}:${YUM_REPOS_D_TARGET}"
VOLUME_MOUNTS+=(--volume "${mount_point}:${YUM_REPOS_D_TARGET}")
fi

DEFAULT_LABELS=(
Expand All @@ -442,12 +446,12 @@ spec:
if [ -e /activation-key/org ]; then
cp -r --preserve=mode "$ACTIVATION_KEY_PATH" /tmp/activation-key
mkdir /shared/rhsm-tmp
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z"
VOLUME_MOUNTS+=(--volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z)
echo "Adding activation key to the build"

elif find /entitlement -name "*.pem" >> null; then
cp -r --preserve=mode "$ENTITLEMENT_PATH" /tmp/entitlement
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume /tmp/entitlement:/etc/pki/entitlement"
VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)
echo "Adding the entitlement to the build"
fi

Expand All @@ -464,13 +468,25 @@ spec:
# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.
declare IMAGE

unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w ${SOURCE_CODE_DIR}/$CONTEXT -- buildah build \
$VOLUME_MOUNTS \
"${BUILDAH_ARGS[@]}" \
"${LABELS[@]}" \
--tls-verify=$TLSVERIFY --no-cache \
--ulimit nofile=4096:4096 \
-f "$dockerfile_copy" -t "$IMAGE" .
buildah_cmd_array=(
buildah build
"${VOLUME_MOUNTS[@]}"
"${BUILDAH_ARGS[@]}"
"${LABELS[@]}"
--tls-verify="$TLSVERIFY" --no-cache
--ulimit nofile=4096:4096
-f "$dockerfile_path" -t "$IMAGE" .
)
buildah_cmd=$(printf "%q " "${buildah_cmd_array[@]}")

if [ "${HERMETIC}" == "true" ]; then
# enabling loopback adapter enables Bazel builds to work in hermetic mode.
command="ip link set lo up && $buildah_cmd"
else
command="$buildah_cmd"
fi

unshare -Uf "${UNSHARE_ARGS[@]}" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w "${SOURCE_CODE_DIR}/$CONTEXT" -- sh -c "$command"

container=$(buildah from --pull-never "$IMAGE")
buildah mount $container | tee /shared/container_path
Expand Down
40 changes: 28 additions & 12 deletions task/buildah/0.2/buildah.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -281,10 +281,12 @@ spec:
)

BUILDAH_ARGS=()
UNSHARE_ARGS=()

if [ "${HERMETIC}" == "true" ]; then
BUILDAH_ARGS+=("--pull=never")
UNSHARE_ARGS="--net"
UNSHARE_ARGS+=("--net")

for image in $BASE_IMAGES; do
unshare -Ufp --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -- buildah pull $image
done
Expand All @@ -309,10 +311,12 @@ spec:
BUILDAH_ARGS+=("--skip-unused-stages=false")
fi

VOLUME_MOUNTS=()

if [ -f "$(workspaces.source.path)/cachi2/cachi2.env" ]; then
cp -r "$(workspaces.source.path)/cachi2" /tmp/
chmod -R go+rwX /tmp/cachi2
VOLUME_MOUNTS="--volume /tmp/cachi2:/cachi2"
VOLUME_MOUNTS+=(--volume /tmp/cachi2:/cachi2)
# Read in the whole file (https://unix.stackexchange.com/questions/533277), then
# for each RUN ... line insert the cachi2.env command *after* any options like --mount
sed -E -i \
Expand All @@ -339,7 +343,7 @@ spec:
if [ -d "${YUM_REPOS_D_FETCHED}" ]; then
chmod -R go+rwX ${YUM_REPOS_D_FETCHED}
mount_point=$(realpath ${YUM_REPOS_D_FETCHED})
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume ${mount_point}:${YUM_REPOS_D_TARGET}"
VOLUME_MOUNTS+=(--volume "${mount_point}:${YUM_REPOS_D_TARGET}")
fi

DEFAULT_LABELS=(
Expand All @@ -363,12 +367,12 @@ spec:
if [ -e /activation-key/org ]; then
cp -r --preserve=mode "$ACTIVATION_KEY_PATH" /tmp/activation-key
mkdir /shared/rhsm-tmp
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z"
VOLUME_MOUNTS+=(--volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z)
echo "Adding activation key to the build"

elif find /entitlement -name "*.pem" >> null; then
cp -r --preserve=mode "$ENTITLEMENT_PATH" /tmp/entitlement
VOLUME_MOUNTS="${VOLUME_MOUNTS} --volume /tmp/entitlement:/etc/pki/entitlement"
VOLUME_MOUNTS+=(--volume /tmp/entitlement:/etc/pki/entitlement)
echo "Adding the entitlement to the build"
fi

Expand All @@ -385,13 +389,25 @@ spec:
# Prevent ShellCheck from giving a warning because 'image' is defined and 'IMAGE' is not.
declare IMAGE

unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w ${SOURCE_CODE_DIR}/$CONTEXT -- buildah build \
$VOLUME_MOUNTS \
"${BUILDAH_ARGS[@]}" \
"${LABELS[@]}" \
--tls-verify=$TLSVERIFY --no-cache \
--ulimit nofile=4096:4096 \
-f "$dockerfile_copy" -t "$IMAGE" .
buildah_cmd_array=(
buildah build
"${VOLUME_MOUNTS[@]}"
"${BUILDAH_ARGS[@]}"
"${LABELS[@]}"
--tls-verify="$TLSVERIFY" --no-cache
--ulimit nofile=4096:4096
-f "$dockerfile_path" -t "$IMAGE" .
)
buildah_cmd=$(printf "%q " "${buildah_cmd_array[@]}")

if [ "${HERMETIC}" == "true" ]; then
# enabling loopback adapter enables Bazel builds to work in hermetic mode.
command="ip link set lo up && $buildah_cmd"
else
command="$buildah_cmd"
fi

unshare -Uf "${UNSHARE_ARGS[@]}" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w "${SOURCE_CODE_DIR}/$CONTEXT" -- sh -c "$command"

container=$(buildah from --pull-never "$IMAGE")
buildah mount $container | tee /shared/container_path
Expand Down
Loading