container pushing updates

[dustymabe]

commit 7d8318095c143fdbd9e97b2747aa880459a5b39e
Author: Dusty Mabe <[email protected]>
Date:   Tue Sep 13 13:57:52 2022 -0400

    build.sh: allow the builder user to run rootless podman
    
    We do *some* podman operations inside the COSA container. If running
    locally as the `builder` user podman will barf when trying to run
    newuidmap if we don't change up the subuid/subgid mappings.
    
    With this change we'll be able to test in our local rootless podman
    COSA container that `cosa push-container-manifest` works.
    
    In order to figure out this worked (at least for what limited podman
    manifest commands I'm running) I first followed the issue at [1]
    and realized I had success with the `quay.io/podman/stable` image
    and then looked inside the image to see what the mapping was.
    I then lifted the mapping from there [2] and applied it here and
    it works.
    
    Note that inside the pipeline right now (in OpenShift) we still run
    as a random user but that seems to still be working OK for us for
    pushing the manifest because it can't find the random UID/GID in
    /etc/{subuid,subgid} so it falls back to "rootless single mapping
    into the namespace".
    
    [1] https://github.com/containers/podman/issues/4056#issuecomment-1245715492
    [2] https://github.com/containers/podman/blob/6e382d9ec2e6eb79a72537544341e496368b6c63/contrib/podmanimage/stable/Containerfile#L25-L26

commit d16a48b72e12d058f1d8df4a9ea2e24856bace0f
Author: Dusty Mabe <[email protected]>
Date:   Tue Sep 13 13:45:35 2022 -0400

    src/cmd-push-container-manifest: support pushing build artifacts
    
    This commit adds an --artifact option to `cosa push-container-manifest`
    which allows for pushing artifacts that were built as part of a
    pipeline build and are referenced in the `meta.json` file to a remote
    registry.
    
    It is multi-arch aware and defaults to pushing a manifest list with
    all the requested architectures available for that build.
    
    Example usage:
    
    cosa push-container-manifest \
        --repo quay.io/dustymabe/fedora-coreos --tag stable --artifact=ostree \
        --metajsonname=base-oscontainer --build=latest --arch=x86_64 --arch=aarch64

commit 826d5eab9862bc2f2dd7872efc7ecba665c6293b
Author: Dusty Mabe <[email protected]>
Date:   Sun Sep 11 09:47:09 2022 -0400

    src/cmd-push-container-manifest: delete inaccurate comment
    
    This file was originally a copy/paste of another file and this comment
    was mistakenly left over from that.
    
    Also fix a typo in the sentence above it.

commit 6c6031a7f4b1817e067ea55655afc97f19755393
Author: Dusty Mabe <[email protected]>
Date:   Tue Sep 13 15:25:21 2022 -0400

    src/cmd-remote-build-container: add --from
    
    This passes through to `podman build` and allows for replacing
    the FROM line in the Containerfile/Dockerfile.

commit 12cb98dbe5d8ebec61f802206dc605921e4a0a32
Author: Dusty Mabe <[email protected]>
Date:   Tue Sep 13 15:07:31 2022 -0400

    src/cmd-remote-build-container: add git repo info as build labels
    
    This takes a similar approach as openshift [1] where some labels with
    information about the git repo are added to the built container image
    to allow for rich information to be inpsected without having to download
    an image from a registry.
    
    Fixes https://github.com/coreos/coreos-assembler/issues/3049
    
    [1] https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/cicd/builds#builds-output-image-labels_managing-build-output

commit cf4da7dd8356584365f06e63e479c051fd763f8a
Author: Dusty Mabe <[email protected]>
Date:   Fri Sep 9 09:23:28 2022 -0400

    src/cmd-remote-build-container: support not pushing to a registry
    
    This will allow us to build containers that we want to deliver in
    our uploaded build artifacts rather than pushed to a registry.

commit 664e46172344fc7ec49482152bda673c5a9aa874
Author: Dusty Mabe <[email protected]>
Date:   Tue Aug 9 15:34:20 2022 -0400

    signal that oscontainer.py and cmd-upload-oscontainer are legacy
    
    These two utilities create old style oscontainer images (i.e.
    not runnable containers). They are on the way out in favor of the
    new OSTree Native Containers.
    
    This commit renames the files to add `deprecated-legacy-format`
    into the filename. It symlinks the old filename back to the new
    filename to keep backwards compatiblity. It's a cosmetic change,
    but hints at our direction.

[dustymabe]

There are a few things going on in this PR. First after this merges we'll be able to switch our FCOS container push to use cosa push-container-manifest, which will be a manifest list for all architectures. Second I added some updates to cosa remote-build-container that should allow us to support the needs of RHCOS in the future with the extensions-container.

[cgwalters]

This is fine, though ultimately I think what we want is to operate on oci directories for this - there's no reason to pull images into containers-storage: here. I am not aware of tooling for this that lives in the github.com/containers ecosystem though.

There's https://github.com/opencontainers/umoci which I think handles this.

[cgwalters]

Also worth noting that this is an overlapping change with #2985 which uses supermin to run podman instead there.

Ultimately what we want is https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/ stabilized - that unblocks clean nested containerization.

[dustymabe]

Also worth noting that this is an overlapping change with #2985 which uses supermin to run podman instead there.

Yep. My suggestion in #3096 (comment) is that in the future (when we don't have clusters per architecture in RHCOS and just have multi-arch builders running FCOS like we do for the FCOS pipeline) we won't do that but rather run the builds through cosa remote-build-container which performs the builds via podman --remote. It's how we're building cosa and fcos-buildroot today.

[ravanelli]

Overall it lgtm, I don't know much about the `oci part to have an opinion though.