Use CentOS 7 base for CI images. #347
Conversation
openshift-bot
added
the
needs-rebase
openshift-ci-robot
added
the
size/XS
dgoodwin
force-pushed
the
centos-ci-image
branch
from
b7ca7d3 to
ea7c9a6
Compare
openshift-bot
removed
the
needs-rebase
| RUN hack/build.sh && hack/get-terraform.sh | ||
|
|
||
| FROM scratch | ||
| FROM centos:7 |
There was a problem hiding this comment.
This is effectively what's happening in production, although it's "whatever the OpenShift base layer is" their and not explicitly "CentOS 7". The image I was building for testing openshift/release#1677 is registry.svc.ci.openshift.org/wking-next-gen-installer/stable:installer in case you want to poke around (I think that is public?). The policy doc has:
Do not ask to have your image based of scratch, busybox, alpine, etc. The request will be denied.
I've dropped an internal comment asking why they forbid scratch, and until then, meh, I'm fine either way ;).
Previously was failing fast due to attempts to write to / as UID 1000, which will not work. Instead create /output, change ownership, and use for WORKDIR.
|
@wking added commit to get running as UID 1000 to work. Afraid I was not able to have it compatible with using scratch, COPY'ing /output from the build container ends up owned by root. Docker added COPY with --chown in 1.17 but we don't ship that nor does buildah support it yet. Might be possible in future. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dgoodwin, wking The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
the
approved
5 participants
Automated Release Tooling recommends basing images on CentOS 7 in their Policies and Standards doc.
Also will be helpful for Hive team as we expect we may need to layer on top of this image and may need some more robust tools than scratch provides.