BUILD-433: Run builds in user namespaces without seccomp if BUILD_PRIVILEGED=false #173
Conversation
openshift-ci-robot
added
the
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: nalind The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
nalind
force-pushed
the
unprivileged
branch
3 times, most recently
from
a279a97 to
a19460f
Compare
|
/retest |
|
/retest |
nalind
force-pushed
the
unprivileged
branch
4 times, most recently
from
3883f6a to
f0af6f5
Compare
|
/retest |
nalind
force-pushed
the
unprivileged
branch
2 times, most recently
from
5297fb4 to
5e11e89
Compare
nalind
force-pushed
the
unprivileged
branch
from
5e11e89 to
a2112d9
Compare
nalind
force-pushed
the
unprivileged
branch
2 times, most recently
from
16754f5 to
3251751
Compare
|
/retest |
nalind
force-pushed
the
unprivileged
branch
2 times, most recently
from
4ba3553 to
3ac5109
Compare
|
/retest-required |
|
/retest |
|
/retest |
|
/retest |
1 similar comment
|
/retest |
|
|
|
/retest |
|
/retest |
|
@coreydaley if you'd like, I can set up this repo for "no-feature-freeze" so you don't need a BZ to merge. |
|
@adambkaplan That would be great, thanks! |
If the BUILD_PRIVILEGED variable is set to "false" or 0 as an integer, set the "Privileged" flag on docker/sti/custom build pod SecurityContexts to false, and put CAP_MKNOD and CAP_KILL in the list of capabilities to drop. If it is set to "true" or non-zero, the "Privileged" flag will be set to true. If it is not set, we still default to privileged. Stop setting BUILD_STORAGE_DRIVER, since we're going to expect the builder image to figure this out on its own. Mount an emptyDir volume at /var/run/containers in setupContainersStorage(), so that we can ensure its permissions will be set so that the build user will always be able to write to it. Move the emptyDir volume for layers from /var/lib/containers/storage to /var/lib/containers, so that the build user can create the storage directory inside of it with exactly the permissions that the build user wants. When the pod security context is not privileged, configure the build pod by setting annotations that should instruct CRI-O to run the pod in a user namespace using mappings that CRI-O selects, and to provide the build pod with a working /dev/fuse. Set the seccomp profile for build pods to "unconfined", since we depend on unshare() and CRI-O is attempting to move away from allowing it to be used in its default seccomp profile. Signed-off-by: Nalin Dahyabhai <[email protected]>
|
/retest |
2 similar comments
|
/retest |
|
/retest |
|
@nalind: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
/lgtm |
openshift-ci
bot
added
the
docs-approved
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: adambkaplan, coreydaley, nalind, RickJWagner, rolfedh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
8 participants
In the build controller, we never actually called
setupContainersNodeStorage(), so remove it, and stop setting the environment variable to force storage to use the overlay driver, which currently requires privileges, leaning on openshift/builder#220 and openshift/builder#291 to have the builder container figure that out for itself.Make the mode which we apply to secret and configuration map volumes in build pods something that the build controller can pass down to its helper functions, so that it can be adjusted based on the strategy. Continue to default them to 0600.Set the seccomp profile for build pods to "unconfined", since we depend on
unshare()and CRI-O is attempting to move away from allowing it to be used in its default seccomp profile.When the Build object's environment includes "BUILD_PRIVILEGED=false" or "BUILD_PRIVILEGED=0":