Replies: 37 comments
-
|
Could you try with --isolation=chroot? |
Beta Was this translation helpful? Give feedback.
-
|
Hello ! Same thing :
|
Beta Was this translation helpful? Give feedback.
-
|
It looks like you are running buildah within a confined environment, while docker is probably leaking the docker.sock into the container and using it. |
Beta Was this translation helpful? Give feedback.
-
|
I can't find any information on the Internet: it seems that nobody builds his image with Gitlab and Buildah |
Beta Was this translation helpful? Give feedback.
-
|
I've got the same problem. |
Beta Was this translation helpful? Give feedback.
-
|
@flouthoc PTAL |
Beta Was this translation helpful? Give feedback.
-
|
Experiencing the same issue. Unable to Note that neither 1.28.3 nor 1.29.0 are available via https://quay.io/repository/buildah/stable so I am not sure how to test them. |
Beta Was this translation helpful? Give feedback.
-
|
I think issue is more with the version |
Beta Was this translation helpful? Give feedback.
-
|
@slonopotamus Please try with |
Beta Was this translation helpful? Give feedback.
-
|
Note that this happens even with More tests
|
Beta Was this translation helpful? Give feedback.
-
|
@slonopotamus Could you try [fl@fedora ~]$ sudo docker run --privileged --user 1000 --rm -it quay.io/buildah/upstream:latest buildah unshare echo hi |
Beta Was this translation helpful? Give feedback.
-
|
It works both with and without Obviously, this is not a way to go due because of security reasons. |
Beta Was this translation helpful? Give feedback.
-
|
So, I'm not sure we're talking about a single issue here. I see that 1.28.0 works better than 1.27.0 or 1.29.0 in some aspect (only 1.28.0 passes |
Beta Was this translation helpful? Give feedback.
-
|
Okay, I know why |
Beta Was this translation helpful? Give feedback.
-
|
how were you able to run nested containers without CAP_SYS_ADMIN and without the possibility to create a new user namespace? Were you using |
Beta Was this translation helpful? Give feedback.
-
|
To my understanding, |
Beta Was this translation helpful? Give feedback.
-
I've created a separate issue for this, since we're talking about something that worked before and now doesn't: #4563 |
Beta Was this translation helpful? Give feedback.
-
|
Here my Kubernetes configuration that works on anthos gke in AWS, if it can help. Build is done in gitlab ci with a kubernetes executor. Here the securityContext needed for the pod where buildah is running: securityContext:
capabilities:
add:
- SETGID
- SETUID
drop:
- ALL
privileged: false
runAsUser: 1000
allowPrivilegeEscalation: trueI drop all capabilities to only allow SETGID and SETUID I also need to set this annotation otherwise apparmor blocks the usage of setgid annotations:
container.apparmor.security.beta.kubernetes.io/build: unconfinedand last my .gitlab-ci.yml image:
name: quay.io/buildah/stable:v1.28
#name: quay.io/buildah/upstream:latest
variables:
HTTP_PROXY: $HTTP_PROXY
HTTPS_PROXY: $HTTPS_PROXY
NO_PROXY: $NO_PROXY
# Use vfs with buildah. Docker offers overlayfs as a default, but buildah
# cannot stack overlayfs on top of another overlayfs filesystem.
#STORAGE_DRIVER: vfs
# Write all image metadata in the docker format, not the standard OCI format.
# Newer versions of docker can handle the OCI format, but older versions, like
# the one shipped with Fedora 30, cannot handle the format.
BUILDAH_FORMAT: docker
# You may need this workaround for some errors: https://stackoverflow.com/a/70438141/1233435
BUILDAH_ISOLATION: chroot
master:
stage: build
only:
- master
script:
- id
- buildah login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- buildah build --build-arg http_proxy=${HTTP_PROXY} --build-arg https_proxy=${HTTPS_PROXY} --build-arg no_proxy=${NO_PROXY} -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA -f $CI_PROJECT_DIR/Dockerfile
- buildah push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
tags:
- k8s |
Beta Was this translation helpful? Give feedback.
-
|
@mick1627 is it true that in your case container runs under containerd/CRI-O or something that is not Docker? As I understand, it might have a different seccomp profile that allows |
Beta Was this translation helpful? Give feedback.
-
but we need a way to create mounts, isolate the Also, keep in mind that VFS is much slower than overlay, creating a new layer requires scanning the entire tree every time |
Beta Was this translation helpful? Give feedback.
-
yes, it's runs under containerd |
Beta Was this translation helpful? Give feedback.
-
|
containerd is running with a tigher seccomp filter that prevents unshare. |
Beta Was this translation helpful? Give feedback.
-
|
A friendly reminder that this issue had no activity for 30 days. |
Beta Was this translation helpful? Give feedback.
-
|
Experiencing the same running GitLab CI on a GKE autopilot. Autopilot prevents the use of privileged containers altogether, which is why I've been using kaniko until now. That thing can't do multi-stage builds at all, and even craps itself on simple builds with no error whatsoever, so here I am pushing all my hopes on buildah. Did anyone get buildah to run in unprivileged containers? |
Beta Was this translation helpful? Give feedback.
-
|
@alucryd could you try running buildah with |
Beta Was this translation helpful? Give feedback.
-
|
@giuseppe Already did, same result: GKE autopilot applies a default seccomp profile you can't modify at all: https://cloud.google.com/kubernetes-engine/docs/concepts/seccomp-in-gke EDIT: didn't pass |
Beta Was this translation helpful? Give feedback.
-
|
As was already discussed above, buildah either needs a privileged container or |
Beta Was this translation helpful? Give feedback.
-
|
So the only real choice out there is, sadly, kaniko :/ The devs don't seem too interested to fix anything though and didn't even respond to my issues so that's a bummer. |
Beta Was this translation helpful? Give feedback.
-
|
Kanino knows that it is already inside a confined environment, so there isn't much value creating a separate namespace to run processes. Buildah though is primarily designed to be run on host machine where it would be insecure to run Dockerfile things as-is without any layer of isolation. If your Dockerfile doesn't need I personally moved to Kaniko, though it has its own issues (for example, total and unexplainable madness with |
Beta Was this translation helpful? Give feedback.
-
|
Buildah requires multiple UIDs and the ability to mount file systems like /proc and /sys. This means either CAP_SYS_ADMIN or creating a user namespace which requires CAP_SETUID and CAP_SETGID, along with the unshare syscall |
Beta Was this translation helpful? Give feedback.
-
Description
With this Dockerfile :
I get the following error:
Steps to reproduce the issue:
Describe the results you received:
I get the following error:
Describe the results you expected:
I am waiting for the image to build
Output of
rpm -q buildahorapt list buildah:I can't, I use Gitlab CI / CD for this
Output of
buildah version:I use Gitlab CI / CD with buildah image
My Gitlab CI / CD configuration :
Beta Was this translation helpful? Give feedback.
All reactions