containers/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2026-02-05 06:45:31 +01:00
Code Issues Releases Wiki Activity

use bootc for os apply

Browse Source 
Instead of using rpm-ostree, we now use bootc for os apply.  the
implementation is a little murky right now and will require some cleanup
to implement bootc's transports.  for now, we only support oci images
from registries.

once we have an upgrade command, the transports can be added and the
docs for apply can be ammended to be more clear.

Fixes: RUN-3836

Signed-off-by: Brent Baude <bbaude@redhat.com>
This commit is contained in:
Brent Baude
2026-01-07 13:53:24 -06:00
parent 78456c1828
commit 76e14f79f7
4 changed files with 27 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/machine/os/machine_os.go
View File

@@ -24,7 +24,7 @@ func (m *MachineOS) Apply(image string, _ ApplyOptions) error {
var off bool
args := []string{"podman", "machine", "os", "apply", image}
if err := machine.LocalhostSSH(m.VM.SSH.RemoteUsername, m.VM.SSH.IdentityPath, m.VMName, m.VM.SSH.Port, args); err != nil {
if err := machine.LocalhostSSHShellForceTerm(m.VM.SSH.RemoteUsername, m.VM.SSH.IdentityPath, m.VMName, m.VM.SSH.Port, args); err != nil {
return err
}

129
pkg/machine/os/ostree.go
View File

@@ -3,138 +3,21 @@
package os
import (
"errors"
"fmt"
"os"
"os/exec"
"regexp"
"strings"
"github.com/sirupsen/logrus"
"go.podman.io/image/v5/transports/alltransports"
)
// OSTree deals with operations on ostree based os's
type OSTree struct{}
// Apply takes an OCI image and does an rpm-ostree rebase on the image
// If no containers-transport is specified,
// apply will first check if the image exists locally, then default to pulling.
// Exec-ing out to rpm-ostree rebase requires sudo, so this means apply cannot
// be called within podman's user namespace if run as rootless.
// This means that we need to export images in containers-storage to oci-dirs
// We also need to do this via an exec, because if we tried to use the ABI functions,
// we would enter the user namespace, the rebase command would fail.
// The pull portion of this function essentially is a work-around for two things:
// 1. rpm-ostree requires you to specify the containers-transport when pulling.
// The pull in podman allows the behavior of os apply to match other podman commands,
// where you only pull if the image does not exist in storage already.
// 2. This works around the root/rootless issue.
// Podman machines are by default set up using a rootless connection.
// rpm-ostree needs to be run as root. If a user wants to use an image in containers-storage,
// rpm-ostree will look at the root storage, and not the user storage, which is unexpected behavior.
// Exporting to an oci-dir works around this, without nagging the user to configure the machine in rootful mode.
// Apply takes an input that describes an image based on transports
// defined by bootc. Omission of a transport assumes the image
// is pulled from an OCI registry. We simply pass the user
// input to bootc without any manipulation.
func (dist *OSTree) Apply(image string, _ ApplyOptions) error {
imageWithTransport := image
transport := alltransports.TransportFromImageName(image)
switch {
// no transport was specified
case transport == nil:
exists, err := execPodmanImageExists(image)
if err != nil {
return err
}
if exists {
fmt.Println("Pulling from", "containers-storage"+":", imageWithTransport)
dir, err := os.MkdirTemp("", pathSafeString(imageWithTransport))
if err != nil {
return err
}
if err := os.Chmod(dir, 0o755); err != nil {
return err
}
defer func() {
if err := os.RemoveAll(dir); err != nil {
logrus.Errorf("failed to remove temporary pull file: %v", err)
}
}()
if err := execPodmanSave(dir, image); err != nil {
return err
}
imageWithTransport = "oci:" + dir
} else {
// if image doesn't exist locally, assume that we want to pull and use docker transport
imageWithTransport = "docker://" + image
}
// containers-transport specified
case transport.Name() == "containers-storage":
fmt.Println("Pulling from", image)
dir, err := os.MkdirTemp("", pathSafeString(strings.TrimPrefix(image, "containers-storage"+":")))
if err != nil {
return err
}
if err := os.Chmod(dir, 0o755); err != nil {
return err
}
defer func() {
if err := os.RemoveAll(dir); err != nil {
logrus.Errorf("failed to remove temporary pull file: %v", err)
}
}()
if err := execPodmanSave(dir, image); err != nil {
return err
}
imageWithTransport = "oci:" + dir
}
ostreeCli := []string{"rpm-ostree", "--bypass-driver", "rebase", fmt.Sprintf("ostree-unverified-image:%s", imageWithTransport)}
cmd := exec.Command("sudo", ostreeCli...)
cli := []string{"bootc", "switch", image}
cmd := exec.Command("sudo", cli...)
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
return cmd.Run()
}
// pathSafeString creates a path-safe name for our tmpdirs
func pathSafeString(str string) string {
alphanumOnly := regexp.MustCompile(`[^a-zA-Z0-9]+`)
return alphanumOnly.ReplaceAllString(str, "")
}
// execPodmanSave execs out to podman save
func execPodmanSave(dir, image string) error {
saveArgs := []string{"image", "save", "--format", "oci-dir", "-o", dir, image}
saveCmd := exec.Command("podman", saveArgs...)
saveCmd.Stdout = os.Stdout
saveCmd.Stderr = os.Stderr
return saveCmd.Run()
}
// execPodmanSave execs out to podman image exists
func execPodmanImageExists(image string) (bool, error) {
existsArgs := []string{"image", "exists", image}
existsCmd := exec.Command("podman", existsArgs...)
if err := existsCmd.Run(); err != nil {
if exitError, ok := err.(*exec.ExitError); ok {
switch exitCode := exitError.ExitCode(); exitCode {
case 1:
return false, nil
default:
return false, errors.New("unable to access local image store")
}
}
}
return true, nil
}

14
pkg/machine/ssh.go
View File

@@ -20,8 +20,13 @@ func LocalhostSSH(username, identityPath, name string, sshPort int, inputArgs []
return localhostBuiltinSSH(username, identityPath, name, sshPort, inputArgs, true, os.Stdin)
}
// LocalhostSSHShellForceTerm runs the native ssh shell client and forces a terminal (-t)
func LocalhostSSHShellForceTerm(username, identityPath, name string, sshPort int, inputArgs []string) error {
return localhostNativeSSH(username, identityPath, name, sshPort, inputArgs, os.Stdin, true)
}
func LocalhostSSHShell(username, identityPath, name string, sshPort int, inputArgs []string) error {
return localhostNativeSSH(username, identityPath, name, sshPort, inputArgs, os.Stdin)
return localhostNativeSSH(username, identityPath, name, sshPort, inputArgs, os.Stdin, false)
}
func LocalhostSSHSilent(username, identityPath, name string, sshPort int, inputArgs []string) error {
@@ -117,13 +122,18 @@ func createLocalhostConfig(user string, identityPath string) (*ssh.ClientConfig,
}, nil
}
func localhostNativeSSH(username, identityPath, name string, sshPort int, inputArgs []string, stdin io.Reader) error {
func localhostNativeSSH(username, identityPath, name string, sshPort int, inputArgs []string, stdin io.Reader, forceTerm bool) error {
sshDestination := username + "@localhost"
port := strconv.Itoa(sshPort)
interactive := true
args := append([]string{"-i", identityPath, "-p", port, sshDestination}, LocalhostSSHArgs()...) // WARNING: This MUST NOT be generalized to allow communication over untrusted networks.
if len(inputArgs) > 0 {
// on the other condition, the term is forced
// anyway
if forceTerm {
args = append(args, "-t")
}
interactive = false
args = append(args, inputArgs...)
} else {