unprivileged: don't try to set up user namespaces for manage-dockerfile/git-clone #254
Conversation
…le/git-clone Don't assume that we can set up a user namespace when we're invoked as openshift-manage-dockerfile or openshift-git-clone, even when not explicitly given mappings to use, since those containers haven't traditionally been run with privileged=true. Signed-off-by: Nalin Dahyabhai <[email protected]>
nalind
force-pushed
the
expected-privileges
branch
from
b3a0b06 to
70bd718
Compare
|
@vrutkovs FYI ... eventually, I wonder if we should create an optional OKD version of e2e-aws-builds in this repo to catch whatever problem you saw in the nightlies .... WDYT? |
|
I'm unlikely to ever argue against adding tests for a thing. How, and how far, does the OKD version diverge from the existing e2e-aws-builds test, though? |
|
On the surface @nalind /lgtm now we need @adambkaplan for the approve label. And, per the feedback from @vrutkovs I'm wondering if there is anything besides adding the equivalent of https://github.com/openshift/release/blob/master/ci-operator/jobs/openshift/cluster-samples-operator/openshift-cluster-samples-operator-master-presubmits.yaml#L505-L573 for openshift/builder so we can get some OKD validation for this. An optional okd-e2e-aws-builds that we could launch from this PR. |
I'll defer to @vrutkovs ... but presumably enough for the OKD nightlies to flag something. |
The main difference is FCOS is used in I can create okd-specific builder test, but we're hitting a DPTP bug in 4.9 rehearsals |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: adambkaplan, gabemontero, nalind The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
1 similar comment
|
/retest-required Please review the full test history for this PR and help us cut down flakes. |
6 participants
Walk back a bit of #220: don't assume that we can set up a user namespace when we're invoked as openshift-manage-dockerfile or openshift-git-clone, even when not explicitly given mappings to use, since those containers haven't traditionally been run with privileged=true.