Skip to content

support docker in rootless images #15924

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

support docker in rootless images #15924

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions components/docker-up/BUILD.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,10 @@ packages:
- :bin-runc-facade
config:
commands:
- ["mkdir", "unarchived"]
- ["tar", "-zxvf", "components-docker-up--bin-docker-up/docker.tgz", "-C", "unarchived"]
- ["cp", "-vaR", "unarchived/docker/.", "."]
- ["rm", "-r", "unarchived"]
Comment on lines +43 to +46
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@akosyakov wdyt of changing this PR title and description? My understanding is you are trying to get gp rebuild working, need the docker CLI, but docker support in rootless images (as a feature) is not required/can be decoupled from this effort.

Suggestions:

  1. As @atduarte suggested, treat embedded docker bin as a portable app. For example, like you mentioned, instead of persisting to unarchived, do so in .supervisor/docker/bin, and then have gp rebuild expect it to be there. This way:
    • The dependency for gp rebuild on the docker CLI does not break or change the end-user experience for docker CLI
    • The IDE team is unblocked
  2. Inbox an issue to the Workspace Team, to consider installing docker CLI as part of docker-up like you have now, so customers get docker support in rootless images. At this time, we could also consider deleting .supervisor/docker/bin. This would be a lower priority given our current priorities.

Regarding deploy for the docker-up change, we prboably have to ship a new workspace cluster (I do not see docker-up as a version that can be overridden in ide-config in the application clusters).

  • registry-facade has a specific docker-up in its configmap for staticLayer :
 "staticLayer": [
      {
        "ref": "eu.gcr.io/gitpod-core-dev/build/supervisor:commit-1e24370e8e1ee19ca3b8d9521e1c205269978680",
        "type": "image"
      },
      {
        "ref": "eu.gcr.io/gitpod-core-dev/build/workspacekit:commit-243207eb85e1ac9ada023fc6ba3a4e3118d49d5e",
        "type": "image"
      },
      {
        "ref": "eu.gcr.io/gitpod-core-dev/build/docker-up:commit-243207eb85e1ac9ada023fc6ba3a4e3118d49d5e",
        "type": "image"
      }
    ],

You shared an internal concern about docker, docker-compose, and runc versions.

  • We have a fork of docker-compose, where we override the MTU here
  • docker and runc updates here were for currency and many issues related to clone3

Copy link
Member Author

@akosyakov akosyakov Jan 24, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have another idea right now to let supervisor to do docker build/run under sudo for gp rebuild, then it can activate docker daemon and use shipped cli even if a user don't have sudo access.

I probably can go with the variant one as well, but it adds complexity since we need to ship docker twice, and it does not strike me that shipping random docker cli has valid usage. As you mentioned version of docker-compose already pinned and overrides whatever user has in the workspace image.

I was thinking to suggest removing docker-up from static layer and instead allow ide-service to deliver it. Then we could agree on something simple like merging this PR and if it does not work revert it with an IDE deployment. With that way we would learn faster and does not need to deliver docker twice.

- ["mv", "components-docker-up--bin-docker-up/docker-up", "docker-up"]
- ["rm", "-r", "components-docker-up--bin-docker-up"]
- ["mv", "components-docker-up--bin-runc-facade/docker-up", "runc-facade"]
Expand Down