Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Investigate usage of Rechunk #217

Closed
fiftydinar opened this issue Aug 11, 2024 · 4 comments
Closed

Investigate usage of Rechunk #217

fiftydinar opened this issue Aug 11, 2024 · 4 comments
Assignees
Labels
type: feature Brand new functionality, features, pages, workflows, endpoints, etc.
Milestone

Comments

@fiftydinar
Copy link
Contributor

fiftydinar commented Aug 11, 2024

It can fix some OCI image issues with permissions & SELinux, while nicely lowering the image size.

https://github.com/hhd-dev/rechunk

Bazzite, Bluefin & Aurora are already experimenting with this.

Would be smart to wait & see how Rechunk will refine over time, while Ublue images use it.

@gmpinder gmpinder self-assigned this Aug 11, 2024
@gmpinder gmpinder added the type: feature Brand new functionality, features, pages, workflows, endpoints, etc. label Aug 11, 2024
@gmpinder gmpinder added this to the v0.10.0 milestone Aug 11, 2024
@prydom
Copy link
Contributor

prydom commented Sep 27, 2024

Working example using OSTree's built-in rechunk feature here that I've been using for months:

https://github.com/prydom/my-ostree-build/blob/ed2b05b29bac9dc0152862f198f166b63380c044/.github/workflows/build.yml#L108-L129

What I currently do is use bluebuild to push the raw image (gzip compressed), then pull with ostree, recommit to relabel, rechunk it (ostree container-encapsulate does not support zstd), then re-compress it to non-chunked zstd (I was running into bugs with chunking), then sign the final image.

It would be nice if some of those steps were integrated together to save time/bandwidth.

@prydom
Copy link
Contributor

prydom commented Sep 27, 2024

Ah, looking at the rechunk repo @hhd-dev and I came up with the same thing independently - I did it to solve SELinux problems with libvirt and increase layer reuse. Consider my example above an alternative implementation using the same primitives - I added it back in April.

@prydom
Copy link
Contributor

prydom commented Sep 27, 2024

https://github.com/hhd-dev/rechunk/blob/master/1_prune.sh does some very invasive and potentially problematic, when used across distros, actions with regards to permissions that ostree-rs-ext handles/applies more safely by using the ostree metadata during ostree checkout. I will report that to the upstream project.

For example, I do very few of the workarounds found in prune (only similar truncating of /etc/passwd and /etc/group and the /usr/etc->/etc/ merge) and have had no issues with booting or permissions.

@prydom
Copy link
Contributor

prydom commented Sep 28, 2024

I had a good discussion with the maintainer of the "rechunk" repo at hhd-dev/rechunk#4.

We discussed the pros and cons of using ostree-rs-ext to extract the post-processed rootfs vs their approach of quirking the permissions and exattrs from a copy of the container image from podman mount. The latter approach requires rootful permissions on builders and the former approach is the only way to maintain xattrs from a base image. However there is a concern about doubling build space requirements when using the former approach, as currently ostree-rs-ext doesn't support unified storage with other containers/storage based tools (e.g. podman). It may be worth waiting for something like containers/bootc#20 to land or possibly code from containers/bootc#215 could be adapted to obtain a rootfs directory that is appropriate for rechunking and avoid an additional copy of the container image being created. We also discussed upstream issue ostreedev/ostree-rs-ext#655 which prevents OCI layered xattr changes from being applied (which may not impact bluebuild if re-chunking is always the last stage).

Also note that https://github.com/hhd-dev/rechunk uses its own chunking algorithm distinct from https://github.com/ostreedev/ostree-rs-ext/blob/main/lib/src/container/encapsulate.rs. It may be worth evaluating if the techniques from @hhd-dev 's repo are appropriate to contribute upstream.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: feature Brand new functionality, features, pages, workflows, endpoints, etc.
Projects
None yet
Development

No branches or pull requests

3 participants