From c512ee946b3e72fddbf7f355647ea0960af80998 Mon Sep 17 00:00:00 2001 From: Honza Horak Date: Tue, 24 Jul 2018 17:21:36 +0200 Subject: [PATCH 01/10] Use just groff-base in s2i-core --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index eece213..4dc83c8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,7 +7,7 @@ with all the tools needed to use source-to-image functionality while keeping \ the image size as small as possible." \ NAME=s2i-core \ VERSION=0 \ - RELEASE=3 \ + RELEASE=4 \ ARCH=x86_64 LABEL summary="$SUMMARY" \ @@ -42,7 +42,7 @@ ENV \ RUN INSTALL_PKGS="bsdtar \ findutils \ gettext \ - groff \ + groff-base \ tar \ unzip" && \ mkdir -p ${HOME}/.pki/nssdb && \ From 93f1fe759091c69853d1db1d87cd62111f7d38dd Mon Sep 17 00:00:00 2001 From: Clement Verna Date: Mon, 27 Aug 2018 10:34:32 +0200 Subject: [PATCH 02/10] Drop Release label in favor of OSBS release_bump plugin. OSBS can automatically bump the release number, for that we just need to drop the label from the Dockerfile See https://pagure.io/ContainerSIG/container-sig/issue/1 Signed-off-by: Clement Verna --- Dockerfile | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 4dc83c8..32d81fe 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # This image is the base image for all s2i configurable container images. -FROM registry.fedoraproject.org/fedora:29 +FROM registry.fedoraproject.org/fedora:rawhide ENV SUMMARY="Base image which allows using of source-to-image." \ DESCRIPTION="The s2i-core image provides any images layered on top of it \ @@ -7,7 +7,6 @@ with all the tools needed to use source-to-image functionality while keeping \ the image size as small as possible." \ NAME=s2i-core \ VERSION=0 \ - RELEASE=4 \ ARCH=x86_64 LABEL summary="$SUMMARY" \ @@ -19,7 +18,6 @@ LABEL summary="$SUMMARY" \ com.redhat.component="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ - release="$RELEASE.$DISTTAG" \ architecture="$ARCH" \ usage="This image is supposed to be used as a base image for other images that support source-to-image" \ maintainer="SoftwareCollections.org " From f3c6bc746413165e69695a89240c7c4c30424077 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marek=20Skalick=C3=BD?= Date: Fri, 30 Nov 2018 17:45:58 +0000 Subject: [PATCH 03/10] Pull changes from upstream and rebase for: rebuild for latest f30 --- Dockerfile | 1 - Dockerfile.fedora | 1 + core | 1 + help.md | 1 + 4 files changed, 3 insertions(+), 1 deletion(-) create mode 120000 Dockerfile.fedora create mode 120000 core create mode 120000 help.md diff --git a/Dockerfile b/Dockerfile index 32d81fe..1439454 100644 --- a/Dockerfile +++ b/Dockerfile @@ -18,7 +18,6 @@ LABEL summary="$SUMMARY" \ com.redhat.component="$NAME" \ name="$FGC/$NAME" \ version="$VERSION" \ - architecture="$ARCH" \ usage="This image is supposed to be used as a base image for other images that support source-to-image" \ maintainer="SoftwareCollections.org " diff --git a/Dockerfile.fedora b/Dockerfile.fedora new file mode 120000 index 0000000..1d1fe94 --- /dev/null +++ b/Dockerfile.fedora @@ -0,0 +1 @@ +Dockerfile \ No newline at end of file diff --git a/core b/core new file mode 120000 index 0000000..945c9b4 --- /dev/null +++ b/core @@ -0,0 +1 @@ +. \ No newline at end of file diff --git a/help.md b/help.md new file mode 120000 index 0000000..42061c0 --- /dev/null +++ b/help.md @@ -0,0 +1 @@ +README.md \ No newline at end of file From 31622b32fff4cc576df0c9f1e1f6bfd3c0a76e3c Mon Sep 17 00:00:00 2001 From: Petr Kubat Date: Wed, 10 Apr 2019 09:28:56 +0200 Subject: [PATCH 04/10] Pull changes from upstream and rebase for: rebuild for latest rawhide --- Dockerfile | 6 +++++- README.md | 12 +++++++----- root/help.1 | 14 +++++++++----- root/usr/bin/cgroup-limits | 2 +- 4 files changed, 22 insertions(+), 12 deletions(-) diff --git a/Dockerfile b/Dockerfile index 1439454..414e438 100644 --- a/Dockerfile +++ b/Dockerfile @@ -29,7 +29,8 @@ ENV \ APP_ROOT=/opt/app-root \ # The $HOME is not set by default, but some applications needs this variable HOME=/opt/app-root/src \ - PATH=/opt/app-root/src/bin:/opt/app-root/bin:$PATH + PATH=/opt/app-root/src/bin:/opt/app-root/bin:$PATH \ + PLATFORM="fedora" # This is the list of basic dependencies that all language container image can # consume. @@ -51,6 +52,9 @@ RUN INSTALL_PKGS="bsdtar \ # Copy extra files to the image. COPY ./root/ / +# Create a platform-python symlink if it does not exist already +RUN [ -e /usr/libexec/platform-python ] || ln -s /usr/libexec/system-python /usr/libexec/platform-python + # Directory with the sources is set as the working directory so all STI scripts # can execute relative to this path. WORKDIR ${HOME} diff --git a/README.md b/README.md index ff9397e..bae6eab 100644 --- a/README.md +++ b/README.md @@ -28,22 +28,23 @@ Two examples: * If you specify `BASH_ENV`, then all your `#!/bin/bash` scripts do not need to call `scl enable`. * If you specify `PROMPT_COMMAND`, then on execution of the -`docker exec ... /bin/bash` command, the collection will be automatically enabled. +`podman exec ... /bin/bash` command, the collection will be automatically enabled. *Note*: Executables in Software Collections packages (e.g., `ruby`) are not directly in a directory named in the `PATH` environment variable. This means that you cannot do: - $ docker exec ... ruby + $ podman exec ... ruby but must instead do: - $ docker exec ... /bin/bash -c ruby + $ podman exec ... /bin/bash -c ruby The `/bin/bash -c`, along with the setting the appropriate environment variable, ensures the correct `ruby` executable is found and invoked. +Note: while the examples in this README are calling `podman`, you can replace any such calls by `docker` with the same arguments Usage ------------------------ @@ -63,7 +64,7 @@ $ make build VERSIONS=core TARGET=rhel7 This image is available on DockerHub. To download it run: ```console -docker pull sclorg/s2i-core-centos7 +podman pull sclorg/s2i-core-centos7 ``` To build a Base image from scratch run: @@ -82,4 +83,5 @@ See also -------- Dockerfile and other sources are available on https://github.com/sclorg/s2i-base-container. In that repository you also can find another variants of S2I Base Dockerfiles. -Dockerfile for CentOS is called Dockerfile, Dockerfile for RHEL is called Dockerfile.rhel7. +The Dockerfile for CentOS is called Dockerfile, the Dockerfile for RHEL7 is called Dockerfile.rhel7, +the Dockerfile for RHEL8 is called Dockerfile.rhel8 and the Dockerfile for Fedora is Dockerfile.fedora. diff --git a/root/help.1 b/root/help.1 index 2f46315..bc055a8 100644 --- a/root/help.1 +++ b/root/help.1 @@ -32,7 +32,7 @@ Two examples: * If you specify \fB\fCBASH\_ENV\fR, then all your \fB\fC#!/bin/bash\fR scripts do not need to call \fB\fCscl enable\fR\&. * If you specify \fB\fCPROMPT\_COMMAND\fR, then on execution of the -\fB\fCdocker exec ... /bin/bash\fR command, the collection will be automatically enabled. +\fB\fCpodman exec ... /bin/bash\fR command, the collection will be automatically enabled. .PP \fINote\fP: @@ -44,7 +44,7 @@ This means that you cannot do: .RS .nf -$ docker exec ... ruby +$ podman exec ... ruby .fi .RE @@ -56,7 +56,7 @@ but must instead do: .RS .nf -$ docker exec ... /bin/bash \-c ruby +$ podman exec ... /bin/bash \-c ruby .fi .RE @@ -65,6 +65,9 @@ $ docker exec ... /bin/bash \-c ruby The \fB\fC/bin/bash \-c\fR, along with the setting the appropriate environment variable, ensures the correct \fB\fCruby\fR executable is found and invoked. +.PP +Note: while the examples in this README are calling \fB\fCpodman\fR, you can replace any such calls by \fB\fCdocker\fR with the same arguments + .SH Usage .PP Choose either the CentOS7 or RHEL7 base image: @@ -93,7 +96,7 @@ This image is available on DockerHub. To download it run: .RS .nf -docker pull sclorg/s2i\-core\-centos7 +podman pull sclorg/s2i\-core\-centos7 .fi .RE @@ -121,4 +124,5 @@ on all provided versions of s2i image.\fP Dockerfile and other sources are available on \[la]https://github.com/sclorg/s2i-base-container\[ra]\&. In that repository you also can find another variants of S2I Base Dockerfiles. -Dockerfile for CentOS is called Dockerfile, Dockerfile for RHEL is called Dockerfile.rhel7. +The Dockerfile for CentOS is called Dockerfile, the Dockerfile for RHEL7 is called Dockerfile.rhel7, +the Dockerfile for RHEL8 is called Dockerfile.rhel8 and the Dockerfile for Fedora is Dockerfile.fedora. diff --git a/root/usr/bin/cgroup-limits b/root/usr/bin/cgroup-limits index b9d4edc..9f1dc1f 100755 --- a/root/usr/bin/cgroup-limits +++ b/root/usr/bin/cgroup-limits @@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/libexec/platform-python """ Script for parsing cgroup information From e23529c292217029fe7cde87c14ebd98971e9d9a Mon Sep 17 00:00:00 2001 From: "Petr \"Stone\" Hracek" Date: Wed, 15 Jan 2020 10:34:06 +0100 Subject: [PATCH 05/10] Update link /usr/libexec/platform-python to /usr/bin/python3 Some other documentation issues from upstream Signed-off-by: Petr "Stone" Hracek --- Dockerfile | 3 ++- root/help.1 | 12 ++++++++++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 414e438..078173a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -41,6 +41,7 @@ RUN INSTALL_PKGS="bsdtar \ findutils \ gettext \ groff-base \ + rsync \ tar \ unzip" && \ mkdir -p ${HOME}/.pki/nssdb && \ @@ -53,7 +54,7 @@ RUN INSTALL_PKGS="bsdtar \ COPY ./root/ / # Create a platform-python symlink if it does not exist already -RUN [ -e /usr/libexec/platform-python ] || ln -s /usr/libexec/system-python /usr/libexec/platform-python +RUN [ -e /usr/libexec/platform-python ] || ln -s /usr/bin/python3 /usr/libexec/platform-python # Directory with the sources is set as the working directory so all STI scripts # can execute relative to this path. diff --git a/root/help.1 b/root/help.1 index bc055a8..5876e29 100644 --- a/root/help.1 +++ b/root/help.1 @@ -1,3 +1,4 @@ +.nh .TH OpenShift base images (core variant) .PP This repository contains Dockerfiles for images which can be used as base images @@ -20,6 +21,8 @@ Normally, SCL requires manual operation to enable the collection you want to use This is burdensome and can be prone to error. The OpenShift S2I approach is to set Bash environment variables that serve to automatically enable the desired collection: + +.RS .IP \(bu 2 \fB\fCBASH\_ENV\fR: enables the collection for all non\-interactive Bash sessions .IP \(bu 2 @@ -27,6 +30,8 @@ serve to automatically enable the desired collection: .IP \(bu 2 \fB\fCPROMPT\_COMMAND\fR: enables the collection in interactive shell +.RE + .PP Two examples: * If you specify \fB\fCBASH\_ENV\fR, then all your \fB\fC#!/bin/bash\fR scripts @@ -86,9 +91,13 @@ $ make build VERSIONS=core TARGET=rhel7 .fi .RE + +.RS .IP \(bu 2 \fBCentOS7 base image\fP +.RE + .PP This image is available on DockerHub. To download it run: @@ -121,8 +130,7 @@ on all provided versions of s2i image.\fP .SH See also .PP -Dockerfile and other sources are available on -\[la]https://github.com/sclorg/s2i-base-container\[ra]\&. +Dockerfile and other sources are available on https://github.com/sclorg/s2i\-base\-container. In that repository you also can find another variants of S2I Base Dockerfiles. The Dockerfile for CentOS is called Dockerfile, the Dockerfile for RHEL7 is called Dockerfile.rhel7, the Dockerfile for RHEL8 is called Dockerfile.rhel8 and the Dockerfile for Fedora is Dockerfile.fedora. From c3a79c911bc91011deeff4c5018d76da8fe96e3d Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Thu, 9 Apr 2020 15:19:09 +0200 Subject: [PATCH 06/10] Update from upstream repository --- Dockerfile | 1 + root/help.1 | 12 ++---------- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/Dockerfile b/Dockerfile index 078173a..a5bd146 100644 --- a/Dockerfile +++ b/Dockerfile @@ -40,6 +40,7 @@ ENV \ RUN INSTALL_PKGS="bsdtar \ findutils \ gettext \ + glibc-langpack-en \ groff-base \ rsync \ tar \ diff --git a/root/help.1 b/root/help.1 index 5876e29..bc055a8 100644 --- a/root/help.1 +++ b/root/help.1 @@ -1,4 +1,3 @@ -.nh .TH OpenShift base images (core variant) .PP This repository contains Dockerfiles for images which can be used as base images @@ -21,8 +20,6 @@ Normally, SCL requires manual operation to enable the collection you want to use This is burdensome and can be prone to error. The OpenShift S2I approach is to set Bash environment variables that serve to automatically enable the desired collection: - -.RS .IP \(bu 2 \fB\fCBASH\_ENV\fR: enables the collection for all non\-interactive Bash sessions .IP \(bu 2 @@ -30,8 +27,6 @@ serve to automatically enable the desired collection: .IP \(bu 2 \fB\fCPROMPT\_COMMAND\fR: enables the collection in interactive shell -.RE - .PP Two examples: * If you specify \fB\fCBASH\_ENV\fR, then all your \fB\fC#!/bin/bash\fR scripts @@ -91,13 +86,9 @@ $ make build VERSIONS=core TARGET=rhel7 .fi .RE - -.RS .IP \(bu 2 \fBCentOS7 base image\fP -.RE - .PP This image is available on DockerHub. To download it run: @@ -130,7 +121,8 @@ on all provided versions of s2i image.\fP .SH See also .PP -Dockerfile and other sources are available on https://github.com/sclorg/s2i\-base\-container. +Dockerfile and other sources are available on +\[la]https://github.com/sclorg/s2i-base-container\[ra]\&. In that repository you also can find another variants of S2I Base Dockerfiles. The Dockerfile for CentOS is called Dockerfile, the Dockerfile for RHEL7 is called Dockerfile.rhel7, the Dockerfile for RHEL8 is called Dockerfile.rhel8 and the Dockerfile for Fedora is Dockerfile.fedora. From 7f3f5ff47b0383fbaa6a6d330527eeb39a353397 Mon Sep 17 00:00:00 2001 From: "Petr \"Stone\" Hracek" Date: Tue, 14 Apr 2020 17:01:48 +0200 Subject: [PATCH 07/10] Add bot-cfg.yml file sync upstream s2i-core repository to Fedora land Signed-off-by: Petr "Stone" Hracek --- bot-cfg.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 bot-cfg.yml diff --git a/bot-cfg.yml b/bot-cfg.yml new file mode 100644 index 0000000..a453e3f --- /dev/null +++ b/bot-cfg.yml @@ -0,0 +1,26 @@ +version: "1" + +betka: + # is betka enabled for this repository + # optional - defaults to false + enabled: true + + # optional + notifications: + email_addresses: [phracek@redhat.com] + + # Specify if master branch in upstream repository is synced + master_checker: true + # Should pull requests be synced? + # optional + pr_checker: false + # Either 'upstream_branch_name' or 'upstream_git_path' has to be specified + # Branch name which is used for sync + upstream_branch_name: master + # Path to directory with dockerfile withing upstream repository + upstream_git_path: "core" + # Github comment message to enforce sync of a pull request + # required if pr_checker is true otherwise optional + pr_comment_message: "[test]" + # optional + image_url: quay.io/rhscl/cwt-generator From b3763415507a45ffc30ea3bb72a17126539ba85d Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Thu, 6 Aug 2020 13:30:32 +0200 Subject: [PATCH 08/10] Rebuild and update from the upstream Github repository --- root/usr/bin/cgroup-limits | 14 ++++++- test/run | 80 ++++++++++++++++++++++++++++++++++---- 2 files changed, 84 insertions(+), 10 deletions(-) diff --git a/root/usr/bin/cgroup-limits b/root/usr/bin/cgroup-limits index 9f1dc1f..2a8bee3 100755 --- a/root/usr/bin/cgroup-limits +++ b/root/usr/bin/cgroup-limits @@ -19,10 +19,12 @@ Variables currently supported: Maximum amount of user memory in bytes. If this value is set to the same value as MAX_MEMORY_LIMIT_IN_BYTES, it means that there is no limit set. The value is taken from - /sys/fs/cgroup/memory/memory.limit_in_bytes + /sys/fs/cgroup/memory/memory.limit_in_bytes for cgroups v1 + and from /sys/fs/cgroup/memory.max for cgroups v2 NUMBER_OF_CORES Number of detected CPU cores that can be used. This value is - calculated from /sys/fs/cgroup/cpuset/cpuset.cpus + calculated from /sys/fs/cgroup/cpuset/cpuset.cpus for cgroups v1 + and from /sys/fs/cgroup/cpuset.cpus.effective for cgroups v2 NO_MEMORY_LIMIT Set to "true" if MEMORY_LIMIT_IN_BYTES is so high that the caller can act as if no memory limit was set. Undefined otherwise. @@ -46,7 +48,11 @@ def get_memory_limit(): """ limit = _read_file('/sys/fs/cgroup/memory/memory.limit_in_bytes') + # If first file does not exist, try cgroups v2 file + limit = limit or _read_file('/sys/fs/cgroup/memory.max') if limit is None or not limit.isdigit(): + if limit == 'max': + return 9223372036854775807 print("Warning: Can't detect memory limit from cgroups", file=sys.stderr) return None @@ -61,7 +67,11 @@ def get_number_of_cores(): core_count = 0 line = _read_file('/sys/fs/cgroup/cpuset/cpuset.cpus') + # If first file does not exist, try cgroups v2 file + line = line or _read_file('/sys/fs/cgroup/cpuset.cpus.effective') if line is None: + # None of the files above exists when running podman as non-root, + # so in that case, this warning is printed every-time print("Warning: Can't detect number of CPU cores from cgroups", file=sys.stderr) return None diff --git a/test/run b/test/run index 9a25c12..da66ed9 100755 --- a/test/run +++ b/test/run @@ -1,6 +1,6 @@ #!/bin/bash # -# The 'run' performs a simple test that verifies that STI image. +# The 'run' performs a simple test that verifies that S2I image. # The main focus is that the image prints out the base-usage properly. # # IMAGE_NAME specifies a name of the candidate image used for testing. @@ -9,18 +9,82 @@ IMAGE_NAME=${IMAGE_NAME-centos/s2i-core-centos7-candidate} test_docker_run_usage() { - echo "Testing 'docker run' usage..." - docker run --rm ${IMAGE_NAME} &>/dev/null + echo "Testing 'docker run' usage..." + docker run --rm ${IMAGE_NAME} &>/dev/null +} + +test_cgroup_limits() { + echo "Testing 'cgroup limits' usage..." + if [ $EUID -eq 0 ]; then + echo " The test is running as root, all tests for cgroup limits will be run" + + # check memory limited (only works when running as root) + echo " Testing 'limited memory' usage..." + if ! ( eval $(docker run --rm --memory=512M ${IMAGE_NAME} /usr/bin/cgroup-limits) + echo "MEMORY_LIMIT_IN_BYTES=$MEMORY_LIMIT_IN_BYTES" + [ "$MEMORY_LIMIT_IN_BYTES" -eq 536870912 ] ); then + echo "MEMORY_LIMIT_IN_BYTES not set to 536870912." + return 1 + fi + + # check cores number (only works when running as root) + echo " Testing 'NUMBER_OF_CORES' value..." + if ! ( eval $(docker run --rm ${IMAGE_NAME} /usr/bin/cgroup-limits) + echo "NUMBER_OF_CORES=$NUMBER_OF_CORES" + [ "$NUMBER_OF_CORES" -gt 0 ] ); then + echo "NUMBER_OF_CORES not set." + return 1 + fi + + # check cores number (only works when running as root) + echo " Testing 'NUMBER_OF_CORES' value with --cpuset-cpus=0..." + if ! ( eval $(docker run --rm --cpuset-cpus=0 ${IMAGE_NAME} /usr/bin/cgroup-limits) + echo "NUMBER_OF_CORES=$NUMBER_OF_CORES" + [ "$NUMBER_OF_CORES" -eq 1 ] ); then + echo "NUMBER_OF_CORES not set to 1 when set --cpuset-cpus=0." + return 1 + fi + + else + echo " The test is running as non-root, some tests for cgroup limits are skipped" + fi + + # check NO_MEMORY_LIMIT when no limit is set + echo " Testing 'NO_MEMORY_LIMIT' value..." + if ! ( eval $(docker run --rm ${IMAGE_NAME} /usr/bin/cgroup-limits) + echo "NO_MEMORY_LIMIT=$NO_MEMORY_LIMIT" + [ "$NO_MEMORY_LIMIT" == 'true' ] ); then + echo "NO_MEMORY_LIMIT not set to true." + return 1 + fi + + # check default memory in bytes + echo " Testing 'MEMORY_LIMIT_IN_BYTES' value..." + if ! ( eval $(docker run --rm ${IMAGE_NAME} /usr/bin/cgroup-limits) + echo "MEMORY_LIMIT_IN_BYTES=$MEMORY_LIMIT_IN_BYTES" + # This value can be different, but it must be very big (comparing to 10TB) + [ "$MEMORY_LIMIT_IN_BYTES" -gt 10000000000000 ] ); then + echo "MEMORY_LIMIT_IN_BYTES not greater than 10000000000000." + return 1 + fi } check_result() { - local result="$1" - if [[ "$result" != "0" ]]; then - echo "STI image '${IMAGE_NAME}' test FAILED (exit code: ${result})" - exit $result - fi + local result="$1" + if [[ "$result" != "0" ]]; then + echo "S2I image '${IMAGE_NAME}' test FAILED (exit code: ${result})" + exit $result + fi } # Verify the 'usage' script is working properly when running the base image with 'docker run ...' test_docker_run_usage check_result $? + +# Verify the cgroup-limits script works as expected +test_cgroup_limits +check_result $? + +echo "Tests for '${IMAGE_NAME}' succeeded." + +# vim: set tabstop=2:shiftwidth=2:expandtab: From 038c97745404e21ac59d578e5d2ce3d1c50197ed Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Wed, 25 Nov 2020 11:28:17 +0100 Subject: [PATCH 09/10] Update from the upstream Github repository --- README.md | 4 ++-- test/run | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index bae6eab..14a94b0 100644 --- a/README.md +++ b/README.md @@ -61,10 +61,10 @@ $ make build VERSIONS=core TARGET=rhel7 * **CentOS7 base image** -This image is available on DockerHub. To download it run: +This image is available on Quay.io. To download it run: ```console -podman pull sclorg/s2i-core-centos7 +podman pull quay.io/centos7/s2i-core-centos7 ``` To build a Base image from scratch run: diff --git a/test/run b/test/run index da66ed9..6878bf3 100755 --- a/test/run +++ b/test/run @@ -6,7 +6,7 @@ # IMAGE_NAME specifies a name of the candidate image used for testing. # The image has to be available before this script is executed. # -IMAGE_NAME=${IMAGE_NAME-centos/s2i-core-centos7-candidate} +test -n "${IMAGE_NAME-}" || { echo 'make sure $IMAGE_NAME is defined'; exit 1; } test_docker_run_usage() { echo "Testing 'docker run' usage..." From 88d457415b57bc96e701133b962f385545a6e37f Mon Sep 17 00:00:00 2001 From: Honza Horak Date: Tue, 8 Jul 2025 17:40:54 +0200 Subject: [PATCH 10/10] container sources not used for building fedora containers anymore --- Dockerfile | 71 -------------- Dockerfile.fedora | 1 - README.md | 87 ----------------- bot-cfg.yml | 26 ------ core | 1 - dead.package | 1 + help.md | 1 - root/help.1 | 128 -------------------------- root/opt/app-root/etc/scl_enable | 2 - root/usr/bin/base-usage | 24 ----- root/usr/bin/cgroup-limits | 102 -------------------- root/usr/bin/container-entrypoint | 2 - root/usr/bin/fix-permissions | 27 ------ root/usr/bin/prepare-yum-repositories | 59 ------------ root/usr/bin/rpm-file-permissions | 21 ----- test/run | 90 ------------------ 16 files changed, 1 insertion(+), 642 deletions(-) delete mode 100644 Dockerfile delete mode 120000 Dockerfile.fedora delete mode 100644 README.md delete mode 100644 bot-cfg.yml delete mode 120000 core create mode 100644 dead.package delete mode 120000 help.md delete mode 100644 root/help.1 delete mode 100644 root/opt/app-root/etc/scl_enable delete mode 100755 root/usr/bin/base-usage delete mode 100755 root/usr/bin/cgroup-limits delete mode 100755 root/usr/bin/container-entrypoint delete mode 100755 root/usr/bin/fix-permissions delete mode 100755 root/usr/bin/prepare-yum-repositories delete mode 100755 root/usr/bin/rpm-file-permissions delete mode 100755 test/run diff --git a/Dockerfile b/Dockerfile deleted file mode 100644 index a5bd146..0000000 --- a/Dockerfile +++ /dev/null @@ -1,71 +0,0 @@ -# This image is the base image for all s2i configurable container images. -FROM registry.fedoraproject.org/fedora:rawhide - -ENV SUMMARY="Base image which allows using of source-to-image." \ - DESCRIPTION="The s2i-core image provides any images layered on top of it \ -with all the tools needed to use source-to-image functionality while keeping \ -the image size as small as possible." \ - NAME=s2i-core \ - VERSION=0 \ - ARCH=x86_64 - -LABEL summary="$SUMMARY" \ - description="$DESCRIPTION" \ - io.k8s.description="$DESCRIPTION" \ - io.k8s.display-name="s2i core" \ - io.openshift.s2i.scripts-url=image:///usr/libexec/s2i \ - io.s2i.scripts-url=image:///usr/libexec/s2i \ - com.redhat.component="$NAME" \ - name="$FGC/$NAME" \ - version="$VERSION" \ - usage="This image is supposed to be used as a base image for other images that support source-to-image" \ - maintainer="SoftwareCollections.org " - -ENV \ - # DEPRECATED: Use above LABEL instead, because this will be removed in future versions. - STI_SCRIPTS_URL=image:///usr/libexec/s2i \ - # Path to be used in other layers to place s2i scripts into - STI_SCRIPTS_PATH=/usr/libexec/s2i \ - APP_ROOT=/opt/app-root \ - # The $HOME is not set by default, but some applications needs this variable - HOME=/opt/app-root/src \ - PATH=/opt/app-root/src/bin:/opt/app-root/bin:$PATH \ - PLATFORM="fedora" - -# This is the list of basic dependencies that all language container image can -# consume. -# Also setup the 'openshift' user that is used for the build execution and for the -# application runtime execution. -# TODO: Use better UID and GID values -RUN INSTALL_PKGS="bsdtar \ - findutils \ - gettext \ - glibc-langpack-en \ - groff-base \ - rsync \ - tar \ - unzip" && \ - mkdir -p ${HOME}/.pki/nssdb && \ - chown -R 1001:0 ${HOME}/.pki && \ - dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && \ - rpm -V $INSTALL_PKGS && \ - dnf clean all -y - -# Copy extra files to the image. -COPY ./root/ / - -# Create a platform-python symlink if it does not exist already -RUN [ -e /usr/libexec/platform-python ] || ln -s /usr/bin/python3 /usr/libexec/platform-python - -# Directory with the sources is set as the working directory so all STI scripts -# can execute relative to this path. -WORKDIR ${HOME} - -ENTRYPOINT ["container-entrypoint"] -CMD ["base-usage"] - -# Reset permissions of modified directories and add default user -RUN rpm-file-permissions && \ - useradd -u 1001 -r -g 0 -d ${HOME} -s /sbin/nologin \ - -c "Default Application User" default && \ - chown -R 1001:0 ${APP_ROOT} diff --git a/Dockerfile.fedora b/Dockerfile.fedora deleted file mode 120000 index 1d1fe94..0000000 --- a/Dockerfile.fedora +++ /dev/null @@ -1 +0,0 @@ -Dockerfile \ No newline at end of file diff --git a/README.md b/README.md deleted file mode 100644 index 14a94b0..0000000 --- a/README.md +++ /dev/null @@ -1,87 +0,0 @@ -OpenShift base images (core variant) -======================================== - -This repository contains Dockerfiles for images which can be used as base images -to add support for [source-to-image](https://github.com/openshift/source-to-image) -without installing several development libraries. - - -Description --------------------------------- -OpenShift S2I images use [Software Collections](https://www.softwarecollections.org/en/) -packages to provide the latest versions of various software. -The SCL packages are released more frequently than the RHEL or CentOS systems, -which are unlikely to change for several years. -We rely on RHEL and CentOS for base images, on the other hand, -because those are stable, supported, and secure platforms. - -Normally, SCL requires manual operation to enable the collection you want to use. -This is burdensome and can be prone to error. -The OpenShift S2I approach is to set Bash environment variables that -serve to automatically enable the desired collection: - -* `BASH_ENV`: enables the collection for all non-interactive Bash sessions -* `ENV`: enables the collection for all invocations of `/bin/sh` -* `PROMPT_COMMAND`: enables the collection in interactive shell - -Two examples: -* If you specify `BASH_ENV`, then all your `#!/bin/bash` scripts -do not need to call `scl enable`. -* If you specify `PROMPT_COMMAND`, then on execution of the -`podman exec ... /bin/bash` command, the collection will be automatically enabled. - -*Note*: -Executables in Software Collections packages (e.g., `ruby`) -are not directly in a directory named in the `PATH` environment variable. -This means that you cannot do: - - $ podman exec ... ruby - -but must instead do: - - $ podman exec ... /bin/bash -c ruby - -The `/bin/bash -c`, along with the setting the appropriate environment variable, -ensures the correct `ruby` executable is found and invoked. - -Note: while the examples in this README are calling `podman`, you can replace any such calls by `docker` with the same arguments - -Usage ------------------------- -Choose either the CentOS7 or RHEL7 base image: -* **RHEL7 base image** - -To build a RHEL7 based image, you need to build it on properly subscribed RHEL machine. - -``` -$ git clone --recursive https://github.com/sclorg/s2i-base-container.git -$ cd s2i-base-container -$ make build VERSIONS=core TARGET=rhel7 -``` - -* **CentOS7 base image** - -This image is available on Quay.io. To download it run: - -```console -podman pull quay.io/centos7/s2i-core-centos7 -``` - -To build a Base image from scratch run: - -``` -$ git clone --recursive https://github.com/sclorg/s2i-base-container.git -$ cd s2i-base-container -$ make build VERSIONS=core -``` - -**Notice: By omitting the `VERSION` parameter, the build/test action will be performed -on all provided versions of s2i image.** - - -See also --------- -Dockerfile and other sources are available on https://github.com/sclorg/s2i-base-container. -In that repository you also can find another variants of S2I Base Dockerfiles. -The Dockerfile for CentOS is called Dockerfile, the Dockerfile for RHEL7 is called Dockerfile.rhel7, -the Dockerfile for RHEL8 is called Dockerfile.rhel8 and the Dockerfile for Fedora is Dockerfile.fedora. diff --git a/bot-cfg.yml b/bot-cfg.yml deleted file mode 100644 index a453e3f..0000000 --- a/bot-cfg.yml +++ /dev/null @@ -1,26 +0,0 @@ -version: "1" - -betka: - # is betka enabled for this repository - # optional - defaults to false - enabled: true - - # optional - notifications: - email_addresses: [phracek@redhat.com] - - # Specify if master branch in upstream repository is synced - master_checker: true - # Should pull requests be synced? - # optional - pr_checker: false - # Either 'upstream_branch_name' or 'upstream_git_path' has to be specified - # Branch name which is used for sync - upstream_branch_name: master - # Path to directory with dockerfile withing upstream repository - upstream_git_path: "core" - # Github comment message to enforce sync of a pull request - # required if pr_checker is true otherwise optional - pr_comment_message: "[test]" - # optional - image_url: quay.io/rhscl/cwt-generator diff --git a/core b/core deleted file mode 120000 index 945c9b4..0000000 --- a/core +++ /dev/null @@ -1 +0,0 @@ -. \ No newline at end of file diff --git a/dead.package b/dead.package new file mode 100644 index 0000000..7290702 --- /dev/null +++ b/dead.package @@ -0,0 +1 @@ +container sources not used for building fedora containers anymore diff --git a/help.md b/help.md deleted file mode 120000 index 42061c0..0000000 --- a/help.md +++ /dev/null @@ -1 +0,0 @@ -README.md \ No newline at end of file diff --git a/root/help.1 b/root/help.1 deleted file mode 100644 index bc055a8..0000000 --- a/root/help.1 +++ /dev/null @@ -1,128 +0,0 @@ -.TH OpenShift base images (core variant) -.PP -This repository contains Dockerfiles for images which can be used as base images -to add support for source\-to\-image -\[la]https://github.com/openshift/source-to-image\[ra] -without installing several development libraries. - -.SH Description -.PP -OpenShift S2I images use Software Collections -\[la]https://www.softwarecollections.org/en/\[ra] -packages to provide the latest versions of various software. -The SCL packages are released more frequently than the RHEL or CentOS systems, -which are unlikely to change for several years. -We rely on RHEL and CentOS for base images, on the other hand, -because those are stable, supported, and secure platforms. - -.PP -Normally, SCL requires manual operation to enable the collection you want to use. -This is burdensome and can be prone to error. -The OpenShift S2I approach is to set Bash environment variables that -serve to automatically enable the desired collection: -.IP \(bu 2 -\fB\fCBASH\_ENV\fR: enables the collection for all non\-interactive Bash sessions -.IP \(bu 2 -\fB\fCENV\fR: enables the collection for all invocations of \fB\fC/bin/sh\fR -.IP \(bu 2 -\fB\fCPROMPT\_COMMAND\fR: enables the collection in interactive shell - -.PP -Two examples: -* If you specify \fB\fCBASH\_ENV\fR, then all your \fB\fC#!/bin/bash\fR scripts -do not need to call \fB\fCscl enable\fR\&. -* If you specify \fB\fCPROMPT\_COMMAND\fR, then on execution of the -\fB\fCpodman exec ... /bin/bash\fR command, the collection will be automatically enabled. - -.PP -\fINote\fP: -Executables in Software Collections packages (e.g., \fB\fCruby\fR) -are not directly in a directory named in the \fB\fCPATH\fR environment variable. -This means that you cannot do: - -.PP -.RS - -.nf -$ podman exec ... ruby - -.fi -.RE - -.PP -but must instead do: - -.PP -.RS - -.nf -$ podman exec ... /bin/bash \-c ruby - -.fi -.RE - -.PP -The \fB\fC/bin/bash \-c\fR, along with the setting the appropriate environment variable, -ensures the correct \fB\fCruby\fR executable is found and invoked. - -.PP -Note: while the examples in this README are calling \fB\fCpodman\fR, you can replace any such calls by \fB\fCdocker\fR with the same arguments - -.SH Usage -.PP -Choose either the CentOS7 or RHEL7 base image: -* \fBRHEL7 base image\fP - -.PP -To build a RHEL7 based image, you need to build it on properly subscribed RHEL machine. - -.PP -.RS - -.nf -$ git clone \-\-recursive https://github.com/sclorg/s2i\-base\-container.git -$ cd s2i\-base\-container -$ make build VERSIONS=core TARGET=rhel7 - -.fi -.RE -.IP \(bu 2 -\fBCentOS7 base image\fP - -.PP -This image is available on DockerHub. To download it run: - -.PP -.RS - -.nf -podman pull sclorg/s2i\-core\-centos7 - -.fi -.RE - -.PP -To build a Base image from scratch run: - -.PP -.RS - -.nf -$ git clone \-\-recursive https://github.com/sclorg/s2i\-base\-container.git -$ cd s2i\-base\-container -$ make build VERSIONS=core - -.fi -.RE - -.PP -\fBNotice: By omitting the \fB\fCVERSION\fR parameter, the build/test action will be performed -on all provided versions of s2i image.\fP - -.SH See also -.PP -Dockerfile and other sources are available on -\[la]https://github.com/sclorg/s2i-base-container\[ra]\&. -In that repository you also can find another variants of S2I Base Dockerfiles. -The Dockerfile for CentOS is called Dockerfile, the Dockerfile for RHEL7 is called Dockerfile.rhel7, -the Dockerfile for RHEL8 is called Dockerfile.rhel8 and the Dockerfile for Fedora is Dockerfile.fedora. diff --git a/root/opt/app-root/etc/scl_enable b/root/opt/app-root/etc/scl_enable deleted file mode 100644 index 8fca598..0000000 --- a/root/opt/app-root/etc/scl_enable +++ /dev/null @@ -1,2 +0,0 @@ -# This file contains automatic SCL enablement. -unset BASH_ENV PROMPT_COMMAND ENV diff --git a/root/usr/bin/base-usage b/root/usr/bin/base-usage deleted file mode 100755 index 154ccc4..0000000 --- a/root/usr/bin/base-usage +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/sh -e - -cat <= 92233720368547: - env_vars["NO_MEMORY_LIMIT"] = "true" - - for key, value in env_vars.items(): - print("{0}={1}".format(key, value)) diff --git a/root/usr/bin/container-entrypoint b/root/usr/bin/container-entrypoint deleted file mode 100755 index 9d8ad4d..0000000 --- a/root/usr/bin/container-entrypoint +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/bash -exec "$@" diff --git a/root/usr/bin/fix-permissions b/root/usr/bin/fix-permissions deleted file mode 100755 index ddd33ac..0000000 --- a/root/usr/bin/fix-permissions +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/sh - -# Allow this script to fail without failing a build -set +e - -SYMLINK_OPT=${2:--L} - -# Fix permissions on the given directory or file to allow group read/write of -# regular files and execute of directories. - -[ $(id -u) -ne 0 ] && CHECK_OWNER=" -uid $(id -u)" - -# If argument does not exist, script will still exit with 0, -# but at least we'll see something went wrong in the log -if ! [ -e "$1" ] ; then - echo "ERROR: File or directory $1 does not exist." >&2 - # We still want to end successfully - exit 0 -fi - -find $SYMLINK_OPT "$1" ${CHECK_OWNER} \! -gid 0 -exec chgrp 0 {} + -find $SYMLINK_OPT "$1" ${CHECK_OWNER} \! -perm -g+rw -exec chmod g+rw {} + -find $SYMLINK_OPT "$1" ${CHECK_OWNER} -perm /u+x -a \! -perm /g+x -exec chmod g+x {} + -find $SYMLINK_OPT "$1" ${CHECK_OWNER} -type d \! -perm /g+x -exec chmod g+x {} + - -# Always end successfully -exit 0 diff --git a/root/usr/bin/prepare-yum-repositories b/root/usr/bin/prepare-yum-repositories deleted file mode 100755 index 3b28993..0000000 --- a/root/usr/bin/prepare-yum-repositories +++ /dev/null @@ -1,59 +0,0 @@ -#!/bin/bash - -# This script is used to prepare yum repositories, that are given as arguments. -# It is no-op if user also mounts the repo file(s) into the container during -# image build. This can be done by one of those commands: -# -# docker build -v /some/repo/file:/etc/yum.repos.d/sclorg_custom.repo -# docker build -v /some/repo/directory:/etc/yum.repos.d -# make CUSTOM_REPO=/some/repo/file/or/directory -# -# The last one works for projects where we have Makefile with the -# container-common-scripts support. - -set -ex - -# DEFAULT_REPOS and SKIP_REPOS_{ENABLE,DISABLE} are intentionally undocumented, -# but might be used if we need to change this behaviour. -# Once we realize there are real use cases for using those variables, we should -# document them properly. -DEFAULT_REPOS=${DEFAULT_REPOS:-"rhel-7-server-rpms rhel-7-server-optional-rpms"} -SKIP_REPOS_ENABLE=${SKIP_REPOS_ENABLE:-false} -SKIP_REPOS_DISABLE=${SKIP_REPOS_DISABLE:-false} - -function is_subscribed() { - for f in /run/secrets/etc-pki-entitlement/*.pem ; do - [ -e "$f" ] && return 0 - break - done - return 1 -} - -# DEBUGGING CASE! Mostly for 'make CUSTOM_REPO=/some/file/or/dir'. -test ! -f /etc/yum.repos.d/sclorg_custom.repo && \ -! mountpoint /etc/yum.repos.d \ - || exit 0 - -# install yum-utils for yum-config-manager -yum install -y yum-utils - -if [ "$SKIP_REPOS_DISABLE" = false ] && is_subscribed; then - # Disable only repos that might come from subscribed host, because there - # might be other repos provided by user or build system - - disable_repos= - # Lines look like: "Repo-id : dist-tag-override/x86_64" - while IFS=' /' read -r _ _ repo_id _; do - case $repo_id in rhel-*) - disable_repos+=" $repo_id" ;; - esac - done <<<"$(yum repolist -v 2>/dev/null | grep Repo-id)" - - if test -n "$disable_repos"; then - yum-config-manager --disable $disable_repos &> /dev/null - fi -fi - -if [ ${SKIP_REPOS_ENABLE} = false ] && [ -n "${DEFAULT_REPOS}" -o $# -gt 0 ] ; then - yum-config-manager --enable ${DEFAULT_REPOS} "$@" -fi diff --git a/root/usr/bin/rpm-file-permissions b/root/usr/bin/rpm-file-permissions deleted file mode 100755 index 8be1fb0..0000000 --- a/root/usr/bin/rpm-file-permissions +++ /dev/null @@ -1,21 +0,0 @@ -#!/bin/sh - -CHECK_DIRS="/ /opt /etc /usr /usr/bin /usr/lib /usr/lib64 /usr/share /usr/libexec" - -rpm_format="[%{FILESTATES:fstate} %7{FILEMODES:octal} %{FILENAMES:shescape}\n]" - -rpm -q --qf "$rpm_format" filesystem | while read line -do - eval "set -- $line" - - case $1 in - normal) ;; - *) continue ;; - esac - - case " $CHECK_DIRS " in - *" $3 "*) - chmod "${2: -4}" "$3" - ;; - esac -done diff --git a/test/run b/test/run deleted file mode 100755 index 6878bf3..0000000 --- a/test/run +++ /dev/null @@ -1,90 +0,0 @@ -#!/bin/bash -# -# The 'run' performs a simple test that verifies that S2I image. -# The main focus is that the image prints out the base-usage properly. -# -# IMAGE_NAME specifies a name of the candidate image used for testing. -# The image has to be available before this script is executed. -# -test -n "${IMAGE_NAME-}" || { echo 'make sure $IMAGE_NAME is defined'; exit 1; } - -test_docker_run_usage() { - echo "Testing 'docker run' usage..." - docker run --rm ${IMAGE_NAME} &>/dev/null -} - -test_cgroup_limits() { - echo "Testing 'cgroup limits' usage..." - if [ $EUID -eq 0 ]; then - echo " The test is running as root, all tests for cgroup limits will be run" - - # check memory limited (only works when running as root) - echo " Testing 'limited memory' usage..." - if ! ( eval $(docker run --rm --memory=512M ${IMAGE_NAME} /usr/bin/cgroup-limits) - echo "MEMORY_LIMIT_IN_BYTES=$MEMORY_LIMIT_IN_BYTES" - [ "$MEMORY_LIMIT_IN_BYTES" -eq 536870912 ] ); then - echo "MEMORY_LIMIT_IN_BYTES not set to 536870912." - return 1 - fi - - # check cores number (only works when running as root) - echo " Testing 'NUMBER_OF_CORES' value..." - if ! ( eval $(docker run --rm ${IMAGE_NAME} /usr/bin/cgroup-limits) - echo "NUMBER_OF_CORES=$NUMBER_OF_CORES" - [ "$NUMBER_OF_CORES" -gt 0 ] ); then - echo "NUMBER_OF_CORES not set." - return 1 - fi - - # check cores number (only works when running as root) - echo " Testing 'NUMBER_OF_CORES' value with --cpuset-cpus=0..." - if ! ( eval $(docker run --rm --cpuset-cpus=0 ${IMAGE_NAME} /usr/bin/cgroup-limits) - echo "NUMBER_OF_CORES=$NUMBER_OF_CORES" - [ "$NUMBER_OF_CORES" -eq 1 ] ); then - echo "NUMBER_OF_CORES not set to 1 when set --cpuset-cpus=0." - return 1 - fi - - else - echo " The test is running as non-root, some tests for cgroup limits are skipped" - fi - - # check NO_MEMORY_LIMIT when no limit is set - echo " Testing 'NO_MEMORY_LIMIT' value..." - if ! ( eval $(docker run --rm ${IMAGE_NAME} /usr/bin/cgroup-limits) - echo "NO_MEMORY_LIMIT=$NO_MEMORY_LIMIT" - [ "$NO_MEMORY_LIMIT" == 'true' ] ); then - echo "NO_MEMORY_LIMIT not set to true." - return 1 - fi - - # check default memory in bytes - echo " Testing 'MEMORY_LIMIT_IN_BYTES' value..." - if ! ( eval $(docker run --rm ${IMAGE_NAME} /usr/bin/cgroup-limits) - echo "MEMORY_LIMIT_IN_BYTES=$MEMORY_LIMIT_IN_BYTES" - # This value can be different, but it must be very big (comparing to 10TB) - [ "$MEMORY_LIMIT_IN_BYTES" -gt 10000000000000 ] ); then - echo "MEMORY_LIMIT_IN_BYTES not greater than 10000000000000." - return 1 - fi -} - -check_result() { - local result="$1" - if [[ "$result" != "0" ]]; then - echo "S2I image '${IMAGE_NAME}' test FAILED (exit code: ${result})" - exit $result - fi -} - -# Verify the 'usage' script is working properly when running the base image with 'docker run ...' -test_docker_run_usage -check_result $? - -# Verify the cgroup-limits script works as expected -test_cgroup_limits -check_result $? - -echo "Tests for '${IMAGE_NAME}' succeeded." - -# vim: set tabstop=2:shiftwidth=2:expandtab: