Re: [atomic-devel] systemd.unit files and atomic upgrade.

2015-05-22 Thread Eric Paris
On Fri, 2015-05-22 at 10:06 -0400, Robert Rati wrote: I've reproduced this issue pretty easily. We have symlinks in /etc/systemd/system that point to common unit files on an NFS share. The unit files in the NFS share are usable and functioning on 7.1.0. Then I do: ostree remote add

[atomic-devel] Ansible on atomic-host

2015-07-27 Thread Eric Paris
So I haven't dug into this, might be wasting people's time, but upstream kube ansible has some 'pre-ansible' tasks to get Rawhide boxes functional with ansible [1]. The bare minimum appears (related to atomic) to be python2 and libselinux-python. I know we added python2 by hand, just want to ask

Re: [atomic-devel] kubernetes pod can't access secret volume due to avc

2015-07-17 Thread Eric Paris
Sadly, no, the only step you missed was disabling SELinux. https://github.com/GoogleCloudPlatform/kubernetes/issues/2630 Is where Paul is tracking his work around these problems. On Fri, 2015-07-17 at 09:50 +0200, Tobias Florek wrote: Hi, using the following atomic host version I can't

Re: [atomic-devel] can fedora atomic 23 be upgraded to 24

2016-06-22 Thread Eric Paris
It would make sense if rpm-ostreed ran as non init_t and if that type have MAC_ADMIN. Not much we that can be done to fix it now, but we could fix policy for 24->25... -Eric On Wed, 2016-06-22 at 10:56 -0400, Micah Abbott wrote: > On 06/22/2016 09:34 AM, Muayyad AlSadi wrote: > > now, it gave me

Re: [atomic-devel] Parallel installing 1.9 and 1.10

2016-03-28 Thread Eric Paris
On Mon, 2016-03-28 at 10:54 -0400, Daniel J Walsh wrote: > Well a couple of points, we are currently blocked from pushing  > docker-1.10 into fedora 23, because > it will break k8s, and it looks like we could have the same problem > when  > we go to ship docker-1.10 > into rhel in May.If we

Re: [atomic-devel] Parallel installing 1.9 and 1.10

2016-03-28 Thread Eric Paris
On Mon, 2016-03-28 at 09:27 -0400, Colin Walters wrote: > Hi, > > In some of my use cases I have OpenShift/Kubernetes clusters that are > primarily certified on 1.9, and so I'd like to keep using that.  But > it'd be useful to be able to quickly try out 1.10 on some of my > nodes, or in cases

Re: [atomic-devel] Fedora 2wk Atomic Blocker Bugs

2017-01-17 Thread Eric Paris
On Tue, 2017-01-17 at 13:42 -0500, Dusty Mabe wrote: > There are a few bugs that are blocking 2wk release. > > - one with the kernel that causes kube dns to not work > * https://bugzilla.redhat.com/show_bug.cgi?id=1414068 > - one with kube that causes selinux breakage > *

Re: [atomic-devel] Has anyone considered packaging dumb-init or tini for use in Fedora/CentOS/RHEL?

2017-03-06 Thread Eric Paris
On Mon, 2017-03-06 at 21:22 -0500, Clayton Coleman wrote: > They'd be really helpful for cases where you don't want full blown > systemd, but want a long running container that needs to reap > processes.  I don't know that one or the other matters, I have a > slight bias for dumb-init in terms of

Re: [atomic-devel] firewalld in atomic host

2017-04-25 Thread Eric Paris
I question if we need firewalld in atomic. It could be a regular container. Or a system container if we need it running before docker. No? Not sure who to ask to look at actually doing it. But yes, I think everyone who has software doing automated updating of iptables rules wants something like