Podman sysext

[JeWe37]

Podman sysext

Initial work on getting a podman sysext to work, see flatcar/Flatcar#112. For now just includes the basic ebuilds required to build the sysext.

A few minor changes to the infrastructure were made, it's now possible to pass the debug flag to emerge when building packages and a sysext can now be built based on multiple packages. The latter was useful as I wanted to include passt for pasta rootless networking in the podman sysext.

Next I intend to look into what a mangle script should include, particularly based on the prior work on podman sysexts based on the docker builder.

This is very much my first time working with this repo, as such I am not familiar with the context. The ebuilds were pulled directly from gentoo. For most, masking on amd64 was disabled and were otherwise kept as-is. For the podman ebuild in particular, gpgme was added as a BDEPEND, as otherwise building the binary package would fail. There appear to be scripts responsible for updating the ebuilds, how does one integrate with those?

How to use

Inside the SDK container, on a host with a kernel that is not too recent(otherwise the ZFS sysext won't build):

./build_packages
./build_image sysext

Testing done

Next to none. This is very much a draft.

• Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update)
• Inspected CI output for image differences: /boot and /usr size, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.

[pothos]

Thanks, for the config or service files we might need to have them be under /usr if that isn't already the case. If /usr is not usable for config files, as is the case for /etc/subuid, /etc/subgid, we would need to create them on load with a helper service. See build_library/sysext_mangle_* and sdk_container/src/third_party/coreos-overlay/coreos-base/oem-*/files/manglefs.sh.

[github-actions]

Build action triggered: https://github.com/flatcar/scripts/actions/runs/8940147973

[JeWe37]

Alright, latest draft takes care of the mangle script. I still want to do more some more testing but not today.

The mangle script in its current form sets up the UID/GID mapping via systemd-tmpfiles which seemed like the neatest solution, alongside the required config files. It also ignores podman* bridge networks, sets up dbus which podman wants for cgroup management, and cleans up extraneous files(only required for development etc.).

[JeWe37]

Regarding the BDEPEND issue for podman, that is arguably an upstream issue, filed that as a bug.

For this PR I used Gentoo unstable versions, is that acceptable? Or should I revert to using only the currently stable versions? I also may need to unmask arm64 separately, I can't test on that myself.

[JeWe37]

Seems to all be working nicely now. I went through and tested what I can think of, running podman containers in rootful and rootless modes works, so do quadlet and pasta networking.

[JeWe37]

So the gpgme issue makes less sense than I expected. With it being in DEPEND, it is installed into the BOARD_ROOT, which should be sufficient. But somehow it is required to be present in the actual / root. The easiest fix for this is to just add it as a package to the SDK container, but this may be some deeper issue that wouldn't be resolved by doing that.

[pothos]

We also need to unmask the arm64 arch for Podman: arm64 build error is - app-containers/podman-5.0.2::portage-stable (masked by: ~arm64 keyword).

[pothos]

I kicked off a build again, rebased so that we have your extension built as artifact. I'll give it a try soon - your tests sound very promising, I hope we don't run into corner cases that need workarounds. I didn't expect the quadlet to work, for example, but it kind of makes sense because the daemon-reload we trigger would generate the units.

[JeWe37]

My mistake it seems I committed the removal of gpgme from the BDEPEND from my testing. I'll fix that in a bit.

[pothos]

Looks great, you can ignore the test failure here, fix in flatcar/mantle#530 (The other two are failing due to the GitHub Action setup).

[pothos]

Great work!

Can you also create a file changelog/changes/2024-05-03-podman.md with

- Provided a Podman Flatcar extension as optional systemd-sysext image with the release. Write 'podman' to `/etc/flatcar/enabled-sysext.conf` through Ignition and the sysext will be installed during provisioning ([scripts#1964](https://github.com/flatcar/scripts/pull/1964))

and when done, please squash all commits into one - but no problem, I can also do it with the merge button.

After merging we should also add a kola tests (new file) and docs for this (extension overview and new file), if you want, you can try this but up to you :)

[JeWe37]

Squashed and changelog added! Commit message is hopefully in the right format.

[pothos]

Thank you