Add support for running bootc bootable containers #54
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Ephemeral COPR build failed. @containers/packit-build please check. |
albertofaria
force-pushed
the
bootc
branch
3 times, most recently
from
cb31a66
to
db868d2
Compare
Signed-off-by: Alberto Faria <afaria@redhat.com>
We attempt to detect if a container image is bootable. We can't easily retrieve the image's labels, so we check if /usr/lib/bootc/install exists and is a directory. If so, it is a bootable container. If it is a bootable container but we're not running under Podman, we fail with an error. Once our container's entrypoint starts running, a background process on the host (outside the container) queries Podman for the image's name and ID, which the OCI runtime does not get but bootc-install needs. It then saves the container image as an OCI archive. It then runs the original container to generate the VM image. We do this using krun [1] so that elevated privileges aren't necessary. Our entrypoint blocks until this is done, and all subsequent logic remains the same. We could potentially avoid the OCI archive creation step by mounting the host's container storage into the container running under krun. This isn't trivial to achieve due to SELinux label and context mismatches between the host and the krun environment, so we leave this optimization for a future date. Closes #26. [1] https://github.com/containers/crun/blob/main/krun.1.md Signed-off-by: Alberto Faria <afaria@redhat.com>
Store them as untagged containerdisks in the user's container storage. They appear in the output of `podman images`, making users aware of their existence and size on disk, and cleanup commands like `podman image prune` remove them. Signed-off-by: Alberto Faria <afaria@redhat.com>
Signed-off-by: Alberto Faria <afaria@redhat.com>
Signed-off-by: Alberto Faria <afaria@redhat.com>
It allows settings the disk size of the VM image that is generated from a bootc container image. Also improve the default disk size by basing it on the container image size. Signed-off-by: Alberto Faria <afaria@redhat.com>
Its value is a random identifier unique to the current run of the current test. Signed-off-by: Alberto Faria <afaria@redhat.com>
This was referenced May 8, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We attempt to detect if a container image is bootable. We can't easily retrieve the image's labels, so we instead look for files under /usr/lib/bootc/install. If there are none, it isn't a bootable container. If it is a bootable container but we're not running under Podman or Docker, we fail with an error.
Once our container's entrypoint starts running, a background process on the host (outside the container) queries Podman/Docker for the image's name and ID, which the OCI runtime does not get but bootc-install needs. It then saves the container image as a docker-archive.
It then runs the original container to generate the VM image. We do this using krun so that elevated privileges aren't necessary. Our entrypoint blocks until this is done, and all subsequent logic remains the same.
We could potentially avoid the docker-archive creation step by mounting the host's container storage into the container running under krun. This isn't trivial to achieve due to SELinux label and context mismatches between the host and the krun environment, so we leave this optimization for a future date.
Closes #26.
TODO: