SiegfriedSiegert/PTU5KAS
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

kas-container: Add support for podman >= 4.1

Browse Source 
Starting with podman 4.1 the --userns=keep-id flag is no longer ignored
for privileged containers leading to an error when trying to start up
such a container (in our case: for ISAR builds):

  Error: keep-id is only supported in rootless mode

To address that we have to move the --userns=keep-id part to a non-ISAR
specific path.

Reported-by: Wadim Klincov <wadim@klincov.com>
Signed-off-by: Florian Bezdeka <florian.bezdeka@siemens.com>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
This commit is contained in:
Florian Bezdeka 2022-06-08 14:44:17 +02:00 committed by Jan Kiszka
parent 42e83cb7a3
commit 2f149509c2
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
kas-container
View File

@ -102,6 +102,14 @@ enable_isar_mode() {
fi
}
enable_oe_mode() {
if [ "${KAS_CONTAINER_ENGINE}" = "podman" ]; then
# The container entry point expects that the current userid
# calling "podman run" has a 1:1 mapping
KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --userns=keep-id"
fi
}
run_clean() {
if [ -n "${KAS_ISAR_ARGS}" ]; then
set_container_image_var
@ -163,7 +171,7 @@ docker)
;;
podman)
KAS_CONTAINER_COMMAND="podman"
KAS_RUNTIME_ARGS="--userns=keep-id --security-opt label=disable"
KAS_RUNTIME_ARGS="--security-opt label=disable"
;;
*)
echo "$0: unknown container engine '${KAS_CONTAINER_ENGINE}'" >&2
@ -359,6 +367,8 @@ fi
if [ "${BUILD_SYSTEM}" = "isar" ]; then
enable_isar_mode
else
enable_oe_mode
fi
set_container_image_var