[
https://issues.apache.org/jira/browse/YUNIKORN-3466?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
weichen lai updated YUNIKORN-3466:
----------------------------------
Description:
h3. Problem
The reproducible build path in the k8shim Makefile runs a golang container
using an unqualified short name:
{code:java}
$(DOCKER) run -t --rm=true --volume "$(DOCKER_BUILDROOT):/buildroot" \
"golang:$(GO_REPRO_VERSION)" sh -c "..." {code}
Docker's daemon transparently prepends "docker.io/library/" to unqualified
image names, so this has worked historically. Podman does not do this: with
short-name-mode=enforcing (the default on Fedora, RHEL, and recent Ubuntu
releases) and no TTY, short-name resolution fails and the build aborts.
h3. Why this surfaces now
The reproducible build path is only entered when REPRO=1. The existing
consumers do not set it: * {{make kind-e2e}} (covered by YUNIKORN-3441) uses
the non-repro branch, so podman support merged there without hitting this. *
However, {{build-image.py}} in yunikorn-release (YUNIKORN-3443) hard-codes
REPRODUCIBLE_BUILDS=1. Once that PR is merged, podman-based release builds will
always trigger this path and fail.
The REPRODUCIBLE_BUILDS=1 path mounts the repo into the container and runs go
build as root. Since Go 1.18, go build does VCS stamping via git, which fails
with detected dubious ownership in repository when the container's root UID
doesn't own the mounted .git (host-owned).
was:
h3. Problem
The reproducible build path in the k8shim Makefile runs a golang container
using an unqualified short name: {code} $(DOCKER) run -t --rm=true --volume
"$(DOCKER_BUILDROOT):/buildroot" \ "golang:$(GO_REPRO_VERSION)" sh -c "..."
{code} Docker's daemon transparently prepends "docker.io/library/" to
unqualified image names, so this has worked historically. Podman does not do
this: with short-name-mode=enforcing (the default on Fedora, RHEL, and recent
Ubuntu releases) and no TTY, short-name resolution fails and the build aborts.
h3. Why this surfaces now
The reproducible build path is only entered when REPRO=1. The existing
consumers do not set it: * {{make kind-e2e}} (covered by YUNIKORN-3441) uses
the non-repro branch, so podman support merged there without hitting this. *
However, {{build-image.py}} in yunikorn-release (YUNIKORN-3443) hard-codes
REPRODUCIBLE_BUILDS=1. Once that PR is merged, podman-based release builds will
always trigger this path and fail.
> Reproducible build fails under podman due to unqualified golang image
> ---------------------------------------------------------------------
>
> Key: YUNIKORN-3466
> URL: https://issues.apache.org/jira/browse/YUNIKORN-3466
> Project: Apache YuniKorn
> Issue Type: Bug
> Components: shim - kubernetes
> Reporter: TingYao Huang
> Assignee: weichen lai
> Priority: Major
>
> h3. Problem
> The reproducible build path in the k8shim Makefile runs a golang container
> using an unqualified short name:
> {code:java}
> $(DOCKER) run -t --rm=true --volume "$(DOCKER_BUILDROOT):/buildroot" \
> "golang:$(GO_REPRO_VERSION)" sh -c "..." {code}
> Docker's daemon transparently prepends "docker.io/library/" to unqualified
> image names, so this has worked historically. Podman does not do this: with
> short-name-mode=enforcing (the default on Fedora, RHEL, and recent Ubuntu
> releases) and no TTY, short-name resolution fails and the build aborts.
> h3. Why this surfaces now
> The reproducible build path is only entered when REPRO=1. The existing
> consumers do not set it: * {{make kind-e2e}} (covered by YUNIKORN-3441) uses
> the non-repro branch, so podman support merged there without hitting this. *
> However, {{build-image.py}} in yunikorn-release (YUNIKORN-3443) hard-codes
> REPRODUCIBLE_BUILDS=1. Once that PR is merged, podman-based release builds
> will always trigger this path and fail.
> The REPRODUCIBLE_BUILDS=1 path mounts the repo into the container and runs go
> build as root. Since Go 1.18, go build does VCS stamping via git, which fails
> with detected dubious ownership in repository when the container's root UID
> doesn't own the mounted .git (host-owned).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
