From c637c4bfa90fb54cee97f7e942174f908857200d Mon Sep 17 00:00:00 2001 From: Jens Petersen Date: Thu, 12 Aug 2021 12:01:58 +0800 Subject: [PATCH 1/6] fedora:35+ no longer includes acl, openssl, systemd (#1988886) and this breaks the koji buildContainer build somehow --- missing-docs | 3 --- 1 file changed, 3 deletions(-) diff --git a/missing-docs b/missing-docs index b634f27..e0159b2 100644 --- a/missing-docs +++ b/missing-docs @@ -1,15 +1,12 @@ -acl bash curl gawk grep gzip libcap -openssl p11-kit pam python3 rpm sed -systemd tar From f7288e68639b440b488f6f06e01c720ce58f21d0 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Thu, 25 Nov 2021 19:46:14 +0100 Subject: [PATCH 2/6] Ensure that coreutils-single is replaced by coreutils-full It's true that the fedora base images no longer come with coreutils-single, but they used to, and the ubi base images still do. Therefore, it's worth being extra defensive about this. It's better to make the build system execute one extra redundant command than expose users to a bug because of a change that snuck in unnoticed. This reverts commit a2171d8742b18b65e22119bf789871b97f000455. https://github.com/containers/toolbox/pull/931 --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index 73fc3f6..f5c0a72 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,6 +13,7 @@ LABEL com.github.containers.toolbox="true" \ COPY README.md / RUN sed -i '/tsflags=nodocs/d' /etc/dnf/dnf.conf +RUN dnf -y swap coreutils-single coreutils-full COPY missing-docs / RUN dnf -y reinstall $( Date: Thu, 25 Nov 2021 19:48:38 +0100 Subject: [PATCH 3/6] extra-packages: Avoid losing mount(8) by accident The util-linux package was added to ensure the presence of the mount(8) command. Currently the package is already pulled in by various dependencies. Therefore, it doesn't increase the size of the image, but serves as a safeguard against any inadvertent changes. Note that starting from Fedora 35 onwards, the fedora base images no longer have mount(8), which increases the importance of this change. https://github.com/containers/toolbox/issues/929 --- extra-packages | 1 + 1 file changed, 1 insertion(+) diff --git a/extra-packages b/extra-packages index 34ee156..105f5b0 100644 --- a/extra-packages +++ b/extra-packages @@ -36,6 +36,7 @@ time traceroute tree unzip +util-linux vte-profile wget which From 86be929465501e2c1babb03c8afb7bf325d26d17 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Wed, 1 Dec 2021 15:16:13 +0100 Subject: [PATCH 4/6] Remove misleading and redundant CMD There's no need to specify a CMD in a Toolbox image because it's specified by 'toolbox create', through 'podman create', when creating a container. A CMD was specified [1] because the Fedora Container Guidelines requires it [2]. The idea behind the guidelines is that the right thing should happen when one runs: $ podman run However, that only makes sense for images targeting single service containers. Toolbox containers and images are different - they are not meant to be used like that to run a single one-off service. Conceptually, 'running' a Toolbox container is expected to provide the user with a reasonable interactive command line experience. Arguably, that means offering something like /bin/bash, not /bin/sh. Also, note that when the CMD was introduced [1], Toolbox containers were actually created, through 'podman create', with /bin/sh as their entry points. So, it did make some sense. However, things have changed since then [3]. The entry point is now 'toolbox init-container'. It's not possible to mention it in the Toolbox image because the /usr/bin/toolbox binary isn't present in the image, and it's not meant to be present. Therefore, today, /bin/sh is simply not the right fit for a Toolbox image's CMD. A better option would be /bin/bash. Note that the fedora base images have their CMD set to /bin/bash, which is inherited by the fedora-toolbox images. So, there are two options. Either repeat the same CMD in the fedora-toolbox images and satisfy the guidelines, or take some liberties and let the CMD be inherited from the fedora base images. This commit takes the latter option. People tend to use the fedora-toolbox images as the starting point for other custom Toolbox images, sometimes for other operating system distributions. It's better to keep them minimal to avoid implying extra requirements. In this case, the CMD is an abstract concept, and the actual entry point is 'toolbox init-container' as specified by 'toolbox create'. Specifying /bin/bash might discourage people from creating custom images that are only meant to have /bin/zsh. Also, note that the current CMD was actually '/bin/sh -c /bin/sh', not /bin/sh. Unless a CMD is specified as an array of command line arguments, it's passed as a single argument to '/bin/sh -c' [4]. So, this: CMD foo bar ... is the same as: CMD [ "/bin/sh", "-c", "foo bar" ] [1] Toolbox commit 5cc2678a3677af44 https://github.com/containers/toolbox/commit/5cc2678a3677af44 [2] https://docs.fedoraproject.org/en-US/containers/guidelines/creation/ [3] Toolbox commit 8b84b5e4604921fa https://github.com/containers/toolbox/pull/160 [4] https://docs.docker.com/engine/reference/builder/#cmd https://github.com/containers/toolbox/issues/885 --- Dockerfile | 2 -- 1 file changed, 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index f5c0a72..917788f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -24,5 +24,3 @@ RUN dnf -y install $( Date: Wed, 1 Dec 2021 16:55:15 +0100 Subject: [PATCH 5/6] Make locate(1) opt-in by default Currently, the entry point of a Toolbox container runs updatedb(8) on start-up, which can be very I/O intensive. This might be a hindrance when troubleshooting performance problems on a host, or when re-creating containers somewhat more frequently. Users can install the mlocate RPM and restart their containers to enable locate(1). https://github.com/containers/toolbox/pull/938 --- extra-packages | 1 - 1 file changed, 1 deletion(-) diff --git a/extra-packages b/extra-packages index 105f5b0..52bf3f3 100644 --- a/extra-packages +++ b/extra-packages @@ -20,7 +20,6 @@ less lsof man-db man-pages -mlocate mtr nano-default-editor nss-mdns From 274bdf9053aa6e56114c9f4fca26f09a89a72ad5 Mon Sep 17 00:00:00 2001 From: Jens Petersen Date: Tue, 9 Aug 2022 14:27:08 +0800 Subject: [PATCH 6/6] findutils missing docs --- missing-docs | 1 + 1 file changed, 1 insertion(+) diff --git a/missing-docs b/missing-docs index e0159b2..7122f7b 100644 --- a/missing-docs +++ b/missing-docs @@ -1,5 +1,6 @@ bash curl +findutils gawk grep gzip