From 9a410ee704b298a668985e11dd2dfede9beb6006 Mon Sep 17 00:00:00 2001
From: Daniel Chadwick <dchadwic@dchadwic.remote.csb>
Date: Thu, 8 Feb 2024 16:24:27 -0500
Subject: [PATCH] OSDOCS9297: Using /dev/fuse to access faster builds

---
 _topic_maps/_topic_map.yml                    |  2 +
 ...nodes-containers-dev-fuse-configuring.adoc | 66 +++++++++++++++++++
 .../containers/nodes-containers-dev-fuse.adoc | 11 ++++
 3 files changed, 79 insertions(+)
 create mode 100644 modules/nodes-containers-dev-fuse-configuring.adoc
 create mode 100644 nodes/containers/nodes-containers-dev-fuse.adoc

diff --git a/_topic_maps/_topic_map.yml b/_topic_maps/_topic_map.yml
index e5fbd5c27f..83ccf5af0b 100644
--- a/_topic_maps/_topic_map.yml
+++ b/_topic_maps/_topic_map.yml
@@ -2507,6 +2507,8 @@ Topics:
     File: nodes-containers-port-forwarding
   - Name: Using sysctls in containers
     File: nodes-containers-sysctls
+  - Name: Accessing faster builds with /dev/fuse
+    File: nodes-containers-dev-fuse
 - Name: Working with clusters
   Dir: clusters
   Topics:
diff --git a/modules/nodes-containers-dev-fuse-configuring.adoc b/modules/nodes-containers-dev-fuse-configuring.adoc
new file mode 100644
index 0000000000..f112573e1c
--- /dev/null
+++ b/modules/nodes-containers-dev-fuse-configuring.adoc
@@ -0,0 +1,66 @@
+// Module included in the following assemblies:
+//
+// * nodes/nodes-containers-dev-fuse.adoc
+
+:_mod-docs-content-type: PROCEDURE
+[id="nodes-containers-dev-fuse-configuring_{context}"]
+= Configuring /dev/fuse on unprivileged pods
+
+As an alternative to the virtual filesystem, you can configure the `/dev/fuse` device to the `io.kubernetes.cri-o.Devices` annotation to access faster builds within unprivileged pods. Using `/dev/fuse` is secure, efficient, and scalable, and allows unprivileged users to mount an overlay filesystem as if the unprivileged pod was privileged. 
+
+.Procedure
+
+. Create the pod.
++
+[source,terminal]
+----
+$ oc exec -ti no-priv -- /bin/bash
+----
++
+[source,terminal]
+----
+$ cat >> Dockerfile <<EOF
+FROM registry.access.redhat.com/ubi9
+EOF
+----
++
+[source,terminal]
+----
+$ podman build .
+----
+
+. Implement `/dev/fuse` by adding the `/dev/fuse` device to the `io.kubernetes.cri-o.Devices` annotation.
++
+[source,yaml]
+----
+io.kubernetes.cri-o.Devices: "/dev/fuse"
+----
++
+For example:
++
+[source,yaml]
+----
+apiVersion: v1
+kind: Pod
+metadata:
+  name: podman-pod
+  annotations:
+    io.kubernetes.cri-o.Devices: "/dev/fuse"
+----
+
+. Configure the `/dev/fuse` device in your pod specifications.
++
+[source,yaml]
+----
+spec:
+  containers:
+  - name: podman-container
+    image: quay.io/podman/stable
+    args:
+    - sleep
+    - "1000000"
+    securityContext:
+      runAsUser: 1000
+----
+
+
diff --git a/nodes/containers/nodes-containers-dev-fuse.adoc b/nodes/containers/nodes-containers-dev-fuse.adoc
new file mode 100644
index 0000000000..71d357cc52
--- /dev/null
+++ b/nodes/containers/nodes-containers-dev-fuse.adoc
@@ -0,0 +1,11 @@
+:_mod-docs-content-type: ASSEMBLY
+:context: nodes-containers-dev-fuse
+[id="nodes-containers-dev-fuse"]
+= Accessing faster builds with /dev/fuse
+include::_attributes/common-attributes.adoc[]
+
+toc::[]
+
+You can configure your pods with the `/dev/fuse` device to access faster builds.
+
+include::modules/nodes-containers-dev-fuse-configuring.adoc[leveloffset=+1]
\ No newline at end of file