From c77c5cbcde53afc2057f744ba7a72ab7ffdbc2c6 Mon Sep 17 00:00:00 2001 From: Petr Kubat Date: Wed, 10 Apr 2019 09:26:44 +0200 Subject: [PATCH 01/11] Pull changes from upstream and rebase for: rebuild for latest f30 --- Dockerfile | 8 ++++++-- README.md | 12 +++++++----- root/help.1 | 14 +++++++++----- root/usr/bin/cgroup-limits | 2 +- 4 files changed, 23 insertions(+), 13 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1439454..f8ed80c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # This image is the base image for all s2i configurable container images. -FROM registry.fedoraproject.org/fedora:rawhide +FROM registry.fedoraproject.org/fedora:30 ENV SUMMARY="Base image which allows using of source-to-image." \ DESCRIPTION="The s2i-core image provides any images layered on top of it \ @@ -29,7 +29,8 @@ ENV \ APP_ROOT=/opt/app-root \ # The $HOME is not set by default, but some applications needs this variable HOME=/opt/app-root/src \ - PATH=/opt/app-root/src/bin:/opt/app-root/bin:$PATH + PATH=/opt/app-root/src/bin:/opt/app-root/bin:$PATH \ + PLATFORM="fedora" # This is the list of basic dependencies that all language container image can # consume. @@ -51,6 +52,9 @@ RUN INSTALL_PKGS="bsdtar \ # Copy extra files to the image. COPY ./root/ / +# Create a platform-python symlink if it does not exist already +RUN [ -e /usr/libexec/platform-python ] || ln -s /usr/libexec/system-python /usr/libexec/platform-python + # Directory with the sources is set as the working directory so all STI scripts # can execute relative to this path. WORKDIR ${HOME} diff --git a/README.md b/README.md index ff9397e..bae6eab 100644 --- a/README.md +++ b/README.md @@ -28,22 +28,23 @@ Two examples: * If you specify `BASH_ENV`, then all your `#!/bin/bash` scripts do not need to call `scl enable`. * If you specify `PROMPT_COMMAND`, then on execution of the -`docker exec ... /bin/bash` command, the collection will be automatically enabled. +`podman exec ... /bin/bash` command, the collection will be automatically enabled. *Note*: Executables in Software Collections packages (e.g., `ruby`) are not directly in a directory named in the `PATH` environment variable. This means that you cannot do: - $ docker exec ... ruby + $ podman exec ... ruby but must instead do: - $ docker exec ... /bin/bash -c ruby + $ podman exec ... /bin/bash -c ruby The `/bin/bash -c`, along with the setting the appropriate environment variable, ensures the correct `ruby` executable is found and invoked. +Note: while the examples in this README are calling `podman`, you can replace any such calls by `docker` with the same arguments Usage ------------------------ @@ -63,7 +64,7 @@ $ make build VERSIONS=core TARGET=rhel7 This image is available on DockerHub. To download it run: ```console -docker pull sclorg/s2i-core-centos7 +podman pull sclorg/s2i-core-centos7 ``` To build a Base image from scratch run: @@ -82,4 +83,5 @@ See also -------- Dockerfile and other sources are available on https://github.com/sclorg/s2i-base-container. In that repository you also can find another variants of S2I Base Dockerfiles. -Dockerfile for CentOS is called Dockerfile, Dockerfile for RHEL is called Dockerfile.rhel7. +The Dockerfile for CentOS is called Dockerfile, the Dockerfile for RHEL7 is called Dockerfile.rhel7, +the Dockerfile for RHEL8 is called Dockerfile.rhel8 and the Dockerfile for Fedora is Dockerfile.fedora. diff --git a/root/help.1 b/root/help.1 index 2f46315..bc055a8 100644 --- a/root/help.1 +++ b/root/help.1 @@ -32,7 +32,7 @@ Two examples: * If you specify \fB\fCBASH\_ENV\fR, then all your \fB\fC#!/bin/bash\fR scripts do not need to call \fB\fCscl enable\fR\&. * If you specify \fB\fCPROMPT\_COMMAND\fR, then on execution of the -\fB\fCdocker exec ... /bin/bash\fR command, the collection will be automatically enabled. +\fB\fCpodman exec ... /bin/bash\fR command, the collection will be automatically enabled. .PP \fINote\fP: @@ -44,7 +44,7 @@ This means that you cannot do: .RS .nf -$ docker exec ... ruby +$ podman exec ... ruby .fi .RE @@ -56,7 +56,7 @@ but must instead do: .RS .nf -$ docker exec ... /bin/bash \-c ruby +$ podman exec ... /bin/bash \-c ruby .fi .RE @@ -65,6 +65,9 @@ $ docker exec ... /bin/bash \-c ruby The \fB\fC/bin/bash \-c\fR, along with the setting the appropriate environment variable, ensures the correct \fB\fCruby\fR executable is found and invoked. +.PP +Note: while the examples in this README are calling \fB\fCpodman\fR, you can replace any such calls by \fB\fCdocker\fR with the same arguments + .SH Usage .PP Choose either the CentOS7 or RHEL7 base image: @@ -93,7 +96,7 @@ This image is available on DockerHub. To download it run: .RS .nf -docker pull sclorg/s2i\-core\-centos7 +podman pull sclorg/s2i\-core\-centos7 .fi .RE @@ -121,4 +124,5 @@ on all provided versions of s2i image.\fP Dockerfile and other sources are available on \[la]https://github.com/sclorg/s2i-base-container\[ra]\&. In that repository you also can find another variants of S2I Base Dockerfiles. -Dockerfile for CentOS is called Dockerfile, Dockerfile for RHEL is called Dockerfile.rhel7. +The Dockerfile for CentOS is called Dockerfile, the Dockerfile for RHEL7 is called Dockerfile.rhel7, +the Dockerfile for RHEL8 is called Dockerfile.rhel8 and the Dockerfile for Fedora is Dockerfile.fedora. diff --git a/root/usr/bin/cgroup-limits b/root/usr/bin/cgroup-limits index b9d4edc..9f1dc1f 100755 --- a/root/usr/bin/cgroup-limits +++ b/root/usr/bin/cgroup-limits @@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/libexec/platform-python """ Script for parsing cgroup information From 65234a7ce04a36524c27f57277243a82c8c0e253 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Thu, 7 Nov 2019 09:38:28 +0100 Subject: [PATCH 02/11] Switch to Fedora 31 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index f8ed80c..8765d4f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # This image is the base image for all s2i configurable container images. -FROM registry.fedoraproject.org/fedora:30 +FROM registry.fedoraproject.org/fedora:31 ENV SUMMARY="Base image which allows using of source-to-image." \ DESCRIPTION="The s2i-core image provides any images layered on top of it \ From 00edf9f3e295b7ba41a0a20cc6dae2dc7a10e185 Mon Sep 17 00:00:00 2001 From: Petr Kubat Date: Thu, 6 Feb 2020 09:49:25 +0100 Subject: [PATCH 03/11] Pull changes from upstream and rebase for: rebuild for latest whatever created from upstream commit: c0d5b29a3b3d25c01c7af38243d0d8a026a40399 --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index 9bf258a..b764bf9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -40,6 +40,7 @@ ENV \ RUN INSTALL_PKGS="bsdtar \ findutils \ gettext \ + glibc-langpack-en \ groff-base \ rsync \ tar \ From 24fb227a61eeec8e7a0662268706bc91afd78ba0 Mon Sep 17 00:00:00 2001 From: "Petr \"Stone\" Hracek" Date: Mon, 30 Mar 2020 15:19:59 +0200 Subject: [PATCH 04/11] Add bot-cfg.yml file Sync upstream s2i-core repository to Fedora land Signed-off-by: Petr "Stone" Hracek --- bot-cfg.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 bot-cfg.yml diff --git a/bot-cfg.yml b/bot-cfg.yml new file mode 100644 index 0000000..fc55adf --- /dev/null +++ b/bot-cfg.yml @@ -0,0 +1,25 @@ +version: "1" + +upstream-to-downstream: + # is betka enabled for this repository + # optional - defaults to false + enabled: true + + # optional + notifications: + email_addresses: [phracek@redhat.com] + + # Specify if master branch in upstream repository is synced + master_checker: true + # Should pull requests be synced? + # optional + pr_checker: false + # Either 'upstream_branch_name' or 'upstream_git_path' has to be specified + # Branch name which is used for sync + upstream_branch_name: master + # Path to directory with dockerfile withing upstream repository + upstream_git_path: "core" + # Github comment message to enforce sync of a pull request + # required if pr_checker is true otherwise optional + pr_comment_message: "[test]" + From 3860c499ed17a1acfe2484739745cfcfadbf3339 Mon Sep 17 00:00:00 2001 From: Petr Hracek Date: Tue, 31 Mar 2020 11:22:46 +0000 Subject: [PATCH 05/11] Rename section from upstream-to-downstream to betka --- bot-cfg.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bot-cfg.yml b/bot-cfg.yml index fc55adf..d5a8a43 100644 --- a/bot-cfg.yml +++ b/bot-cfg.yml @@ -1,6 +1,6 @@ version: "1" -upstream-to-downstream: +betka: # is betka enabled for this repository # optional - defaults to false enabled: true From 494e68e7efc2e30a1309dda0af8eab5d8693d711 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Thu, 9 Apr 2020 14:50:18 +0200 Subject: [PATCH 06/11] Update from upstream github repository --- root/help.1 | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/root/help.1 b/root/help.1 index 5876e29..bc055a8 100644 --- a/root/help.1 +++ b/root/help.1 @@ -1,4 +1,3 @@ -.nh .TH OpenShift base images (core variant) .PP This repository contains Dockerfiles for images which can be used as base images @@ -21,8 +20,6 @@ Normally, SCL requires manual operation to enable the collection you want to use This is burdensome and can be prone to error. The OpenShift S2I approach is to set Bash environment variables that serve to automatically enable the desired collection: - -.RS .IP \(bu 2 \fB\fCBASH\_ENV\fR: enables the collection for all non\-interactive Bash sessions .IP \(bu 2 @@ -30,8 +27,6 @@ serve to automatically enable the desired collection: .IP \(bu 2 \fB\fCPROMPT\_COMMAND\fR: enables the collection in interactive shell -.RE - .PP Two examples: * If you specify \fB\fCBASH\_ENV\fR, then all your \fB\fC#!/bin/bash\fR scripts @@ -91,13 +86,9 @@ $ make build VERSIONS=core TARGET=rhel7 .fi .RE - -.RS .IP \(bu 2 \fBCentOS7 base image\fP -.RE - .PP This image is available on DockerHub. To download it run: @@ -130,7 +121,8 @@ on all provided versions of s2i image.\fP .SH See also .PP -Dockerfile and other sources are available on https://github.com/sclorg/s2i\-base\-container. +Dockerfile and other sources are available on +\[la]https://github.com/sclorg/s2i-base-container\[ra]\&. In that repository you also can find another variants of S2I Base Dockerfiles. The Dockerfile for CentOS is called Dockerfile, the Dockerfile for RHEL7 is called Dockerfile.rhel7, the Dockerfile for RHEL8 is called Dockerfile.rhel8 and the Dockerfile for Fedora is Dockerfile.fedora. From a9574f4d07a4cd730792660eb4cb4510920c3424 Mon Sep 17 00:00:00 2001 From: "Petr \"Stone\" Hracek" Date: Tue, 14 Apr 2020 16:52:53 +0200 Subject: [PATCH 07/11] Enable cwt-generator Signed-off-by: Petr "Stone" Hracek --- bot-cfg.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bot-cfg.yml b/bot-cfg.yml index d5a8a43..a453e3f 100644 --- a/bot-cfg.yml +++ b/bot-cfg.yml @@ -22,4 +22,5 @@ betka: # Github comment message to enforce sync of a pull request # required if pr_checker is true otherwise optional pr_comment_message: "[test]" - + # optional + image_url: quay.io/rhscl/cwt-generator From 22b90968c064d2982da26ed2affe5500f71c1246 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Wed, 10 Jun 2020 10:02:14 +0200 Subject: [PATCH 08/11] Add release LABEL to fix OSBS tags --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index b764bf9..a4c81f4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -18,6 +18,7 @@ LABEL summary="$SUMMARY" \ com.redhat.component="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ + release="27.container" usage="This image is supposed to be used as a base image for other images that support source-to-image" \ maintainer="SoftwareCollections.org " From 80e334468f60f2990e8c0a780eb29373b7e5b593 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Thu, 11 Jun 2020 15:41:12 +0200 Subject: [PATCH 09/11] typo fix --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index a4c81f4..00796bb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -18,7 +18,7 @@ LABEL summary="$SUMMARY" \ com.redhat.component="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ - release="27.container" + release="27.container" \ usage="This image is supposed to be used as a base image for other images that support source-to-image" \ maintainer="SoftwareCollections.org " From 6d9be117f9f4362bdb0d9c21899d2e13c3dc2cf9 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Thu, 16 Jul 2020 06:49:29 +0200 Subject: [PATCH 10/11] Remove temporary manual release tag --- Dockerfile | 1 - 1 file changed, 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 00796bb..b764bf9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -18,7 +18,6 @@ LABEL summary="$SUMMARY" \ com.redhat.component="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ - release="27.container" \ usage="This image is supposed to be used as a base image for other images that support source-to-image" \ maintainer="SoftwareCollections.org " From e9e68b05fceea53a3f772d0bdcf527920ed39168 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Thu, 16 Jul 2020 06:51:28 +0200 Subject: [PATCH 11/11] Update from the upstream Github repository --- root/usr/bin/cgroup-limits | 14 ++++++- test/run | 80 ++++++++++++++++++++++++++++++++++---- 2 files changed, 84 insertions(+), 10 deletions(-) diff --git a/root/usr/bin/cgroup-limits b/root/usr/bin/cgroup-limits index 9f1dc1f..2a8bee3 100755 --- a/root/usr/bin/cgroup-limits +++ b/root/usr/bin/cgroup-limits @@ -19,10 +19,12 @@ Variables currently supported: Maximum amount of user memory in bytes. If this value is set to the same value as MAX_MEMORY_LIMIT_IN_BYTES, it means that there is no limit set. The value is taken from - /sys/fs/cgroup/memory/memory.limit_in_bytes + /sys/fs/cgroup/memory/memory.limit_in_bytes for cgroups v1 + and from /sys/fs/cgroup/memory.max for cgroups v2 NUMBER_OF_CORES Number of detected CPU cores that can be used. This value is - calculated from /sys/fs/cgroup/cpuset/cpuset.cpus + calculated from /sys/fs/cgroup/cpuset/cpuset.cpus for cgroups v1 + and from /sys/fs/cgroup/cpuset.cpus.effective for cgroups v2 NO_MEMORY_LIMIT Set to "true" if MEMORY_LIMIT_IN_BYTES is so high that the caller can act as if no memory limit was set. Undefined otherwise. @@ -46,7 +48,11 @@ def get_memory_limit(): """ limit = _read_file('/sys/fs/cgroup/memory/memory.limit_in_bytes') + # If first file does not exist, try cgroups v2 file + limit = limit or _read_file('/sys/fs/cgroup/memory.max') if limit is None or not limit.isdigit(): + if limit == 'max': + return 9223372036854775807 print("Warning: Can't detect memory limit from cgroups", file=sys.stderr) return None @@ -61,7 +67,11 @@ def get_number_of_cores(): core_count = 0 line = _read_file('/sys/fs/cgroup/cpuset/cpuset.cpus') + # If first file does not exist, try cgroups v2 file + line = line or _read_file('/sys/fs/cgroup/cpuset.cpus.effective') if line is None: + # None of the files above exists when running podman as non-root, + # so in that case, this warning is printed every-time print("Warning: Can't detect number of CPU cores from cgroups", file=sys.stderr) return None diff --git a/test/run b/test/run index 9a25c12..da66ed9 100755 --- a/test/run +++ b/test/run @@ -1,6 +1,6 @@ #!/bin/bash # -# The 'run' performs a simple test that verifies that STI image. +# The 'run' performs a simple test that verifies that S2I image. # The main focus is that the image prints out the base-usage properly. # # IMAGE_NAME specifies a name of the candidate image used for testing. @@ -9,18 +9,82 @@ IMAGE_NAME=${IMAGE_NAME-centos/s2i-core-centos7-candidate} test_docker_run_usage() { - echo "Testing 'docker run' usage..." - docker run --rm ${IMAGE_NAME} &>/dev/null + echo "Testing 'docker run' usage..." + docker run --rm ${IMAGE_NAME} &>/dev/null +} + +test_cgroup_limits() { + echo "Testing 'cgroup limits' usage..." + if [ $EUID -eq 0 ]; then + echo " The test is running as root, all tests for cgroup limits will be run" + + # check memory limited (only works when running as root) + echo " Testing 'limited memory' usage..." + if ! ( eval $(docker run --rm --memory=512M ${IMAGE_NAME} /usr/bin/cgroup-limits) + echo "MEMORY_LIMIT_IN_BYTES=$MEMORY_LIMIT_IN_BYTES" + [ "$MEMORY_LIMIT_IN_BYTES" -eq 536870912 ] ); then + echo "MEMORY_LIMIT_IN_BYTES not set to 536870912." + return 1 + fi + + # check cores number (only works when running as root) + echo " Testing 'NUMBER_OF_CORES' value..." + if ! ( eval $(docker run --rm ${IMAGE_NAME} /usr/bin/cgroup-limits) + echo "NUMBER_OF_CORES=$NUMBER_OF_CORES" + [ "$NUMBER_OF_CORES" -gt 0 ] ); then + echo "NUMBER_OF_CORES not set." + return 1 + fi + + # check cores number (only works when running as root) + echo " Testing 'NUMBER_OF_CORES' value with --cpuset-cpus=0..." + if ! ( eval $(docker run --rm --cpuset-cpus=0 ${IMAGE_NAME} /usr/bin/cgroup-limits) + echo "NUMBER_OF_CORES=$NUMBER_OF_CORES" + [ "$NUMBER_OF_CORES" -eq 1 ] ); then + echo "NUMBER_OF_CORES not set to 1 when set --cpuset-cpus=0." + return 1 + fi + + else + echo " The test is running as non-root, some tests for cgroup limits are skipped" + fi + + # check NO_MEMORY_LIMIT when no limit is set + echo " Testing 'NO_MEMORY_LIMIT' value..." + if ! ( eval $(docker run --rm ${IMAGE_NAME} /usr/bin/cgroup-limits) + echo "NO_MEMORY_LIMIT=$NO_MEMORY_LIMIT" + [ "$NO_MEMORY_LIMIT" == 'true' ] ); then + echo "NO_MEMORY_LIMIT not set to true." + return 1 + fi + + # check default memory in bytes + echo " Testing 'MEMORY_LIMIT_IN_BYTES' value..." + if ! ( eval $(docker run --rm ${IMAGE_NAME} /usr/bin/cgroup-limits) + echo "MEMORY_LIMIT_IN_BYTES=$MEMORY_LIMIT_IN_BYTES" + # This value can be different, but it must be very big (comparing to 10TB) + [ "$MEMORY_LIMIT_IN_BYTES" -gt 10000000000000 ] ); then + echo "MEMORY_LIMIT_IN_BYTES not greater than 10000000000000." + return 1 + fi } check_result() { - local result="$1" - if [[ "$result" != "0" ]]; then - echo "STI image '${IMAGE_NAME}' test FAILED (exit code: ${result})" - exit $result - fi + local result="$1" + if [[ "$result" != "0" ]]; then + echo "S2I image '${IMAGE_NAME}' test FAILED (exit code: ${result})" + exit $result + fi } # Verify the 'usage' script is working properly when running the base image with 'docker run ...' test_docker_run_usage check_result $? + +# Verify the cgroup-limits script works as expected +test_cgroup_limits +check_result $? + +echo "Tests for '${IMAGE_NAME}' succeeded." + +# vim: set tabstop=2:shiftwidth=2:expandtab: