Current status (and problems) of running Buildah as non root

 Posted on 25 February 2018  |  4 minutes  |  Giuseppe Scrivano

Having Buildah running in an user namespace opens the possibility of building container images as a not root user. I’ve done some work to get Buildah running in an user container. There are still some open issues to get it fully working. The biggest open one is that overlayfs cannot be currently used as non root user. There is some work going on, but this will require changes in the kernel and the way extended attributes work for overlay. [Read More]

New COPR repository for crun

 Posted on 15 November 2017  |  1 minutes  |  Giuseppe Scrivano

I made a new COPR repository for CRUN so that it can be easily tested on Fedora: https://copr.fedorainfracloud.org/coprs/gscrivano/crun/ To install crun on Fedora, it is enough to: # dnf install 'dnf-command(copr)' # dnf -y copr enable gscrivano/crun # dnf install -y crun a recent change in the atomic tool, which didn’t still get into a release, allows to easily override the OCI runtime for system containers. Assuming you are using atomic from the upstream repository, you can use crun as: [Read More]

C is a better fit for tools like an OCI runtime

 Posted on 23 October 2017  |  2 minutes  |  Giuseppe Scrivano

I’ve spent some of the last weeks working on a replacement for runC, the most used/known OCI runtime for running containers. It might not be very well known, but it is a key component for running containers. Every Docker container ultimately runs through runC. Having containers running through some common specs allow some pieces to be replaced without having any difference in behavior. The OCI runtime specs describe how a container looks like once it is running, for instance it lists all the mount points, the capabilities left to the process, the process that must be executed, the namespaces to create and so on. [Read More]

OpenShift on system containers

 Posted on 23 February 2017  |  5 minutes  |  Giuseppe Scrivano

It is still an ongoing work not ready for production, but the upstream version of OpenShift origin has already an experimental support for running OpenShift Origin using system containers. The “latest” Docker image for origin, node and openvswitch, the 3 components we need, are automatically pushed to docker.io, so we can use these for our test. The rhel7/etcd system container image instead is pulled from the Red Hat registry. This demo is based on these blog posts www. [Read More]
atomic  openshift  system containers 

Facebook detox? 

 Posted on 27 December 2016  |  1 minutes  |  Giuseppe Scrivano

I have been using Facebook for the last years to fill every dead time:waiting for the bus, ads on TV, compiling, etc. The quality of the information coming from Facebook is inferior to any other social network, at least to my experience (it can be I follow/know the wrong people), though the part of the brain that controls procrastination seems addicted to this lower quality information and the chattering there. Also, I don’t want to simply delete my Facebook account and move on, most of the people I know are present only there, neither I want to be more “asocial”. [Read More]

use bubblewrap as an unprivileged user to run systemd images

 Posted on 22 October 2016  |  3 minutes  |  Giuseppe Scrivano

bubblewrap is a sandboxing tool that allows unprivileged users to run containers. I was recently working on a way to allow unprivileged users, to take advantage of bubblewrap to run regular system images that are using systemd. To do so, it was necessary to modify bubblewrap to keep some capabilities in the sandbox. Capabilities are the way, since Linux 2.2, that the kernel uses to split the root power into a finer grained set of permissions that each thread can have. [Read More]

Brainfuc**d brainf**k

 Posted on 11 May 2016  |  2 minutes  |  Giuseppe Scrivano

Every programmer at some point gets in touch with the Brainfuck programming language and how surprising is that very few instructions are needed to have a Turing complete language, 6 is the case of Brainfuck (plus other 2 for I/O operations). I have recently found an old project of mine that I have used to learn how to write a GCC frontend, it took a while to adapt it to work with a newer GCC version. [Read More]

Refactoring a function name across several patches with git rebase

 Posted on 22 April 2016  |  2 minutes  |  Giuseppe Scrivano

git rebase is one of my favorite git commands. It allows to update a set of local patches against another git branch and also to rework, trough the -i flag some previous patches. The problem I had to deal with was quite simple, rename a function called notProperPythonCode to proper_python that was defined in the first patch and be sure that all other patches are using the correct name. The –exec flag allows to run a custom script after each patch is applied, so that I could run sed to process the Python files and replace the old function name with the new one. [Read More]

System containers for Atomic

 Posted on 24 March 2016  |  1 minutes  |  Giuseppe Scrivano

The main reason behind system containers was the inability to run Flannel in a Docker container as Flannel is required by Docker itself. CoreOS solved this chicken and egg problem by using another instance of Docker (called early-docker) that is used to setup only Etcd and Flannel. Differently, Atomic system containers will be managed by runc and systemd. The container images, even though being served through the Docker v2 registry, are slighty different than a regular Docker container in order to be used by Atomic. [Read More]