Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make the root-downloaded images available to non-root users #705

Closed
wants to merge 1 commit into from
Closed

Make the root-downloaded images available to non-root users #705

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions training/ilab-wrapper/ilab
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,15 @@ if [[ "$1" = "shell" ]]; then
export PARAMS=()
fi

PODMAN_COMMAND=("podman" "run" "--rm" "-it"
PODMAN_COMMAND=(
"podman" "run" "--rm" "-it"
"--device" "${CONTAINER_DEVICE}"
"--security-opt" "label=disable" "--net" "host"
"-v" "$HOME:$HOME"
"--env" "HOME"
"--storage-opt" "overlay.mount_program=/usr/bin/fuse-overlayfs"
"--storage-opt" "overlay.force_mask=shared"
"--storage-opt" "additionalimagestore=/usr/lib/containers/storage"
"--env" "HOME"
"--entrypoint" "$ENTRYPOINT"
"--env" "HF_TOKEN"
"${IMAGE_NAME}")
Expand Down
11 changes: 7 additions & 4 deletions training/nvidia-bootc/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,13 +206,16 @@ VOLUME /var/lib/containers

RUN --mount=type=secret,id=${INSTRUCTLAB_IMAGE_PULL_SECRET}/.dockerconfigjson \
if [ -f "/run/.input/instructlab-nvidia/oci-layout" ]; then \
IID=$(podman --root /usr/lib/containers/storage pull oci:/run/.input/instructlab-nvidia) && \
IID=$(podman --root /usr/lib/containers/storage --storage-opt 'overlay.force_mask=shared' --storage-opt 'overlay.mount_program=/usr/bin/fuse-overlayfs' pull oci:/run/.input/instructlab-nvidia) && \
podman --root /usr/lib/containers/storage image tag ${IID} ${INSTRUCTLAB_IMAGE}; \
elif [ -f "/run/secrets/${INSTRUCTLAB_IMAGE_PULL_SECRET}/.dockerconfigjson" ]; then \
IID=$(sudo podman --root /usr/lib/containers/storage pull --authfile /run/secrets/${INSTRUCTLAB_IMAGE_PULL_SECRET}/.dockerconfigjson ${INSTRUCTLAB_IMAGE}); \
IID=$(sudo podman --root /usr/lib/containers/storage --storage-opt 'overlay.force_mask=shared' --storage-opt 'overlay.mount_program=/usr/bin/fuse-overlayfs' pull --authfile /run/secrets/${INSTRUCTLAB_IMAGE_PULL_SECRET}/.dockerconfigjson ${INSTRUCTLAB_IMAGE}); \
else \
IID=$(sudo podman --root /usr/lib/containers/storage pull ${INSTRUCTLAB_IMAGE}); \
fi
IID=$(sudo podman --root /usr/lib/containers/storage --storage-opt 'overlay.force_mask=shared' --storage-opt 'overlay.mount_program=/usr/bin/fuse-overlayfs' pull ${INSTRUCTLAB_IMAGE}); \
fi \
&& chmod a+rx -R /usr/lib/containers
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you still need to do this, or does this happen automatically with the force_mask=shared flag?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm good question, I thought I still needed it but that was before I realized --root was causing my config to be ignored. I'll have another try without it see what happens

Copy link
Contributor Author

@omertuc omertuc Jul 30, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It still seems to be partially required, as while the permissions inside the diff directory are a+rx'd as expected, the other surrounding directories are not:

bash-5.1# cd /usr/lib
bash-5.1# ls -lah containers
drwx------.   3 root root   46 Jan  1  1970 containers
bash-5.1# cd containers/
bash-5.1# ls -lah
total 12K
drwx------.  3 root root  46 Jan  1  1970 .
drwxr-xr-x. 40 root root 866 Jan  1  1970 ..
drwx------.  7 root root 244 Jan  1  1970 storage
bash-5.1# cd storage/
bash-5.1# ls -lah
total 148K
drwx------. 7 root root  244 Jan  1  1970 .
drwx------. 3 root root   46 Jan  1  1970 ..
-rw-r--r--. 1 root root 112K Jan  1  1970 db.sql
-rw-r--r--. 1 root root    8 Jan  1  1970 defaultNetworkBackend
drwx------. 2 root root   27 Jan  1  1970 libpod
drwx------. 4 root root  146 Jan  1  1970 overlay
drwx------. 2 root root   54 Jan  1  1970 overlay-containers
drwx------. 3 root root  149 Jan  1  1970 overlay-images
drwx------. 2 root root  162 Jan  1  1970 overlay-layers
-rw-r--r--. 1 root root   64 Jan  1  1970 storage.lock
-rw-r--r--. 1 root root    0 Jan  1  1970 userns.lock
bash-5.1# cd overlay
bash-5.1# cd 9fd35ed55c106b3cbc36bc3f0f34c5a2df71fef0969b1ea323fc9470497d8ba4/
bash-5.1# ls -lah
total 28K
drwx------.  6 root root 110 Jan  1  1970 .
drwx------.  4 root root 146 Jan  1  1970 ..
drwxr-xr-x. 20 root root 417 Jan  1  1970 diff
drwx------.  2 root root  27 Jan  1  1970 empty
-rw-r--r--.  1 root root  26 Jan  1  1970 link
drwx------.  2 root root  27 Jan  1  1970 merged
drwx------.  2 root root  27 Jan  1  1970 work
bash-5.1# cd diff/
bash-5.1# ls -lah
total 116K
drwxr-xr-x. 20 root root  417 Jan  1  1970 .
drwx------.  6 root root  110 Jan  1  1970 ..
-rwxr-xr-x.  1 root root  17K Jan  1  1970 NGC-DL-CONTAINER-LICENSE
drwxr-xr-x.  2 root root   27 Jan  1  1970 afs
lrwxrwxrwx.  1 root root    7 Jan  1  1970 bin -> usr/bin
drwxr-xr-x.  2 root root   27 Jan  1  1970 boot
drwxr-xr-x.  2 root root   27 Jan  1  1970 dev
drwxr-xr-x. 51 root root 4.0K Jan  1  1970 etc
drwxr-xr-x.  2 root root   27 Jan  1  1970 home
drwxr-xr-x.  2 root root   27 Jan  1  1970 instructlab
lrwxrwxrwx.  1 root root    7 Jan  1  1970 lib -> usr/lib
lrwxrwxrwx.  1 root root    9 Jan  1  1970 lib64 -> usr/lib64
drwxr-xr-x.  2 root root   27 Jan  1  1970 lost+found
drwxr-xr-x.  2 root root   27 Jan  1  1970 media
drwxr-xr-x.  2 root root   27 Jan  1  1970 mnt
drwxr-xr-x.  3 root root   45 Jan  1  1970 opt
drwxr-xr-x.  2 root root   27 Jan  1  1970 proc
drwxr-xr-x.  5 root root  308 Jan  1  1970 root
drwxr-xr-x. 14 root root  258 Jan  1  1970 run
lrwxrwxrwx.  1 root root    8 Jan  1  1970 sbin -> usr/sbin
drwxr-xr-x.  2 root root   27 Jan  1  1970 srv
drwxr-xr-x.  2 root root   27 Jan  1  1970 sys
drwxr-xr-x.  2 root root   27 Jan  1  1970 tmp
drwxr-xr-x. 12 root root  209 Jan  1  1970 usr
drwxr-xr-x. 18 root root  332 Jan  1  1970 var

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW with chmod there is a+rX (note the capitalization) which only sets the executable bit if it's already set elsewhere, which is definitely what we want here.

Also, I don't see a need to traverse into the container roots, we just need to chmod on the containers and overlay directories I believe.


RUN podman system reset --force 2>/dev/null

LABEL image_version_id="${IMAGE_VERSION_ID}"