From 75bdc3196fd6959290d5ba8a0981f494c27e5c8c Mon Sep 17 00:00:00 2001 From: Chris Evich Date: Mon, 5 Dec 2022 08:15:37 -0500 Subject: [PATCH 1/4] Docs: Update volume creation section Signed-off-by: Chris Evich --- README.md | 35 ++++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 15 deletions(-) diff --git a/README.md b/README.md index db6a71a..ef11f8a 100644 --- a/README.md +++ b/README.md @@ -27,21 +27,20 @@ lacks this feature, Several labels are set on the image to support easy registration and execution of a runner container using a special bash command. See the examples below for more information. -#### [Volume Ownership Bug](https://github.com/containers/podman/issues/16576) +#### [Volume setup] -Some versions of podman contain a bug where named local volumes aren't owned -by the namespaced user within a rootless container (i.e. the 'podman' user). -Since the `podman` user/group inside the `pipglr` container is known, it's -possible to manually setup ownership ahead of time. This should be be done -once, prior to registering your runners: +Since podman inside the container runs as user `podman`, the volumes +used by it need to be pre-created with ownership information. While, +we're at it, might as well add the performance-improving `noatime`, +option as well. ```bash -$ for VOLUME in pipglr-podman-root pipglr-config pipglr-podman-cache; do \ +$ VOLOPTS="o=uid=1000,gid=1000,noatime"; \ + for VOLUME in pipglr-podman-root pipglr-config pipglr-podman-cache; do \ + podman volume create --opt $VOLOPTS $VOLUME || true ; \ VOLPTH=$(podman unshare podman volume mount $VOLUME) - podman volume create $VOLUME; \ - podman unshare chown -R 1000:1000 $VOLPTH && \ - podman unshare chmod 02770 $VOLPTH && \ - podman unshare ls -land $VOLPTH ; \ + podman unshare chown -c -R 1000:1000 $VOLPTH && \ + podman unshare chmod -c 02770 $VOLPTH && \ podman unshare podman volume unmount $VOLUME ; \ done ``` @@ -49,7 +48,7 @@ $ for VOLUME in pipglr-podman-root pipglr-config pipglr-podman-cache; do \ If you get `podman system service` startup permission-denied errors, or errors from gitlab-runner, unable to connect to the podman socket, this is likely the cause. You can fix it after-the-fact using the same commands -above. additionally target `./*`. +above. #### Runner registration @@ -112,6 +111,12 @@ For example, to display the config: $ podman unshare cat $(podman unshare podman volume mount pipglr-config)/config.toml ``` +Edit the config with your favorite `$EDITOR`: + +```bash +$ podman unshare $EDITOR $(podman unshare podman volume mount pipglr-config)/config.toml +``` + #### Debugging The first thing to check is the container output: @@ -120,9 +125,9 @@ The first thing to check is the container output: $ podman logs --since 0 pipglr ``` -Before starting the runner, you may `export PODMAN_RUNNER_DEBUG=debug` to enable -debugging on the inner-podman. Whereas `export LOG_LEVEL=debug` can be used to -debug the gitlab-runner itself. +Next, try running pipglr after an `export PODMAN_RUNNER_DEBUG=debug` to enable +debugging on the inner-podman. If more runner detail is needed, you can instead/additionally +set `export LOG_LEVEL=debug` to debug the gitlab-runner itself. ## Building From 51ce5e4e0ac543c1a30c837e61f8b22f60e8dbb0 Mon Sep 17 00:00:00 2001 From: Chris Evich Date: Mon, 5 Dec 2022 08:49:13 -0500 Subject: [PATCH 2/4] Use single uid/gid map The podman base-image is intended to support running nested-podman both root and rootless. Since pipglr only ever runs rootless, eliminate the nested usernamespace mapping needed to support nested-root usage. Signed-off-by: Chris Evich --- Containerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Containerfile b/Containerfile index 5316c12..9771f1c 100644 --- a/Containerfile +++ b/Containerfile @@ -97,7 +97,8 @@ RUN sed -i -r \ chown -R podman:podman /home/podman && \ chmod u+s /usr/bin/new{uid,gid}map && \ rm -f /home/podman/.bash* && \ - echo DOCKER_HOST="unix:///tmp/podman-run-1000/podman/podman.sock" > /etc/profile.d/podman.sh + echo DOCKER_HOST="unix:///tmp/podman-run-1000/podman/podman.sock" > /etc/profile.d/podman.sh && \ + echo "podman:10000:10000" | tee /etc/subuid > /etc/subgid # Runtime rootless-mode configuration USER podman From 4c1af406f734afc50a7a0e199af95231a61e8b33 Mon Sep 17 00:00:00 2001 From: Chris Evich Date: Mon, 5 Dec 2022 08:17:44 -0500 Subject: [PATCH 3/4] Cache prior build layers for ~5 days This vastly improves build performance at the cost of some extra registry server storage (which there is plenty of). Note: The cache TTL needs to be coordinated with the registry server's tag-cleanup policy. Signed-off-by: Chris Evich --- .gitlab-ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 2d1cb20..cb87d73 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -47,6 +47,8 @@ build: echo "Building/Pushing to: ${CI_REGISTRY_IMAGE}:${IMAGE_TAG}"; - >- buildah build \ + --layers --cache-from "${CI_REGISTRY_IMAGE}" \ + --cache-to "${CI_REGISTRY_IMAGE}" --cache-ttl=128h \ --label "org.opencontainers.image.source=${CI_PROJECT_URL}" \ --label "org.opencontainers.image.revision=$CI_COMMIT_SHA" \ --label "org.opencontainers.image.created=$CI_JOB_STARTED_AT" \ From 4fbe33bdbdb3b6a8826188977e3297f7f3df6e8c Mon Sep 17 00:00:00 2001 From: Chris Evich Date: Tue, 6 Dec 2022 02:20:14 -0500 Subject: [PATCH 4/4] Revert "Cache prior build layers for ~5 days" This reverts commit 4c1af406f734afc50a7a0e199af95231a61e8b33. For whatever reason, trying to build this using the community runners always results in an out-of-diskspace error. Signed-off-by: Chris Evich --- .gitlab-ci.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index cb87d73..2d1cb20 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -47,8 +47,6 @@ build: echo "Building/Pushing to: ${CI_REGISTRY_IMAGE}:${IMAGE_TAG}"; - >- buildah build \ - --layers --cache-from "${CI_REGISTRY_IMAGE}" \ - --cache-to "${CI_REGISTRY_IMAGE}" --cache-ttl=128h \ --label "org.opencontainers.image.source=${CI_PROJECT_URL}" \ --label "org.opencontainers.image.revision=$CI_COMMIT_SHA" \ --label "org.opencontainers.image.created=$CI_JOB_STARTED_AT" \