Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"podman pod create --infra --infra-image" does not execute entrypoint of the infra-image #2182

Closed
sysrich opened this issue Jan 18, 2019 · 15 comments
Assignees
Labels
kind/bug Categorizes issue or PR as related to a bug. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.

Comments

@sysrich
Copy link
Contributor

sysrich commented Jan 18, 2019

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

In openSUSE land we want to establish our own pause container, and because we have a nice structured way of building and testing containers, we want to use it for our new pause container.

This means that we have a prototype pause rpm package hosted at https://build.opensuse.org/package/view_file/home:favogt:kubix-images/kubic-pause/kubic-pause.spec?expand=1

With a prototype pause container definition at https://build.opensuse.org/package/view_file/home:favogt:kubix-images/kubic-pause-image/config.kiwi?expand=1

coming together to produce registry.opensuse.org/home/favogt/kubix-images/tw/kubic/pause:0.9

As you can see in the .kiwi link, the OCI container has a defined entry-point of /usr/bin/kubic-pause

However podman pod create --infra --infra-image registry.opensuse.org/home/favogt/kubix-images/tw/kubic/pause:0.9 produces the following error

error starting Infra Container: container create failed: container_linux.go:344: starting container process caused "exec: \"/pause\": stat /pause: no such file or directory"
: internal libpod error

In short, it seems podman is trying to call /pause and ignoring the entrypoint of my --infra container.
I think this is a bug.

Steps to reproduce the issue:

  1. Use podman pod create --infra --infra-image with an OCI image with an entrypoint other than /pause

Describe the results you expected:

Podman should honour the entrypoint defined in it's infra containers

Output of podman version:

Version:       1.0.0
Go Version:    go1.11.4
OS/Arch:       linux/amd64

Output of podman info:

host:
  BuildahVersion: 1.6-dev
  Conmon:
    package: podman-1.0.0-1.1.x86_64
    path: /usr/lib/podman/bin/conmon
    version: 'conmon version 1.12.0-dev, commit: '
  Distribution:
    distribution: '"opensuse-tumbleweed"'
    version: "20190115"
  MemFree: 20020473856
  MemTotal: 33540788224
  OCIRuntime:
    package: runc-1.0.0~rc6-2.1.x86_64
    path: /usr/bin/runc
    version: |-
      runc version 1.0.0-rc6
      spec: 1.0.1-dev
  SwapFree: 34359734272
  SwapTotal: 34359734272
  arch: amd64
  cpus: 8
  hostname: iwreckit.suse.de
  kernel: 4.20.0-1-default
  os: linux
  rootless: false
  uptime: 5h 26m 20.53s (Approximately 0.21 days)
insecure registries:
  registries: []
registries:
  registries:
  - docker.io
store:
  ConfigFile: /etc/containers/storage.conf
  ContainerStore:
    number: 0
  GraphDriverName: overlay
  GraphOptions: null
  GraphRoot: /var/lib/containers/storage
  GraphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
  ImageStore:
    number: 2
  RunRoot: /var/run/containers/storage
@openshift-ci-robot openshift-ci-robot added the kind/bug Categorizes issue or PR as related to a bug. label Jan 18, 2019
@mheon
Copy link
Member

mheon commented Jan 18, 2019

I think at present we force a /pause entrypoint (compatability for the common use Kubernetes pause image). I think it would be reasonable to look up the image first, check if it has ENTRYPOINT set, and use that instead (and default to /pause if not present).

We should also add a flag to set the command for the infra container - I can see cases where I might want to do a pause container with a full init system running, so I can share the PID namespace in the pod and get proper reaping of dead processes.

@mheon
Copy link
Member

mheon commented Jan 18, 2019

Which reminds me...
@vrothberg We should probably disable mounting an init into the container if it's joining another container's PID namespace (for pods, for example) - --init doesn't make sense when you aren't the owner of the PID ns.

@vrothberg
Copy link
Member

Which reminds me...
@vrothberg We should probably disable mounting an init into the container if it's joining another container's PID namespace (for pods, for example) - --init doesn't make sense when you aren't the owner of the PID ns.

We're already doing that :)

@mheon
Copy link
Member

mheon commented Jan 18, 2019

I love it when I think of things and they're already handled. Nice!

@rhatdan
Copy link
Member

rhatdan commented Jan 18, 2019

@sysrich Could you try to modify the entrypoint and see if this changes the behaviour?

@sysrich
Copy link
Contributor Author

sysrich commented Jan 18, 2019

@rhatdan tried - it doesn't change the behaviour

error starting Infra Container: container create failed: container_linux.go:344: starting container process caused "exec: \"/pause\": stat /pause: no such file or directory"
: internal libpod error

@sysrich
Copy link
Contributor Author

sysrich commented Jan 18, 2019

I think what I'm requesting is related to the use of the InfraCommand function

https://github.com/containers/libpod/blob/d8683219d2ac5fd9a0aa271ef9d94cebe0c2adc0/libpod/runtime.go#L187

This is currently set to a default of /pause

https://github.com/containers/libpod/blob/d8683219d2ac5fd9a0aa271ef9d94cebe0c2adc0/libpod/runtime.go#L65

I would like that default to be $entrypoint, then /pause if $entrypoint is not set

Regardless it should still be overridden by options like podman pod create --infra-command

@rhatdan
Copy link
Member

rhatdan commented Jan 18, 2019

Open a PR and we can review.

@rhatdan
Copy link
Member

rhatdan commented Jan 18, 2019

But that seems reasonable.

@sysrich
Copy link
Contributor Author

sysrich commented Jan 18, 2019

@rhatdan ha! as comfortable as I am poking around your code and pointing at things, I haven't written a single line of go and I'm not sure I'm brave enough to start.. if this bug lingers, I might find myself forced..but allow this comment to be my public statement of reluctance in the hope someone better and smarter than me beats me to it ;)

@mheon
Copy link
Member

mheon commented Jan 18, 2019

I think we also might want to look at other things from the image we want to use here - environment variables might be necessary?

@rhatdan
Copy link
Member

rhatdan commented Jan 18, 2019

No problem, Matt can look into this.

@mheon
Copy link
Member

mheon commented Feb 5, 2019

I'll take a look at this tomorrow

@rhatdan
Copy link
Member

rhatdan commented Mar 8, 2019

@haircommander Since you are mister podman pod, could you check this out?

@haircommander
Copy link
Collaborator

haircommander commented Mar 8, 2019

@sysrich --infra-command is an option by the way!

@rhatdan rhatdan closed this as completed Mar 8, 2019
@github-actions github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 24, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 24, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
kind/bug Categorizes issue or PR as related to a bug. locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments.
Projects
None yet
Development

No branches or pull requests

6 participants