Start container with repos support for legacy ISO only [HMS-11156] - #2582
Open
achilleas-k wants to merge 8 commits into
Open
Start container with repos support for legacy ISO only [HMS-11156]#2582achilleas-k wants to merge 8 commits into
achilleas-k wants to merge 8 commits into
Conversation
This package was emptied out a while ago but somehow these two files survived the move.
No need for a boolean to track if a separate build container has been started. Only define the deferred stopping in the same place where we start it.
It's not "from cobra".
Import pkg/distro/bootc as bootcdistro and pkg/bootc as bootc. It's much nicer than importing bootc as podman_container.
Rename the property to storeOpts (store options) since that's the only thing they're used for.
We don't always need network access and secrets when running the container. In fact, we only need those two things in one case, when initialising the dnf repo configs to build an anaconda-iso. Split the container initialiser into two variants. The default, NewContainer(), starts the container without networking and without bind mounting secrets explicitly. Secrets are still bind mounted implicitly by podman if running outside a container. A second initialiser, NewContainerWithRepos(), works like the previous initialiser did, which uses host networking and explicitly bind mounts secrets. Now we can limit the permissions of the container such that it only has network and secrets access when needed.
When generating the manifest for the legacy anaconda ISO, start the container (or the build container, when different from the base) with repos support, meaning it has network access and the secrets are bind mounted from the host.
achilleas-k
force-pushed
the
bootc-podman-restrict
branch
from
August 5, 2026 23:01
826f53b to
b41353a
Compare
Member
Author
|
We don't test with RHEL bootc containers in CI, but I did a lot of manual local testing for this. No manifests were affected by the change. Testing included:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When generating the manifest for the legacy anaconda ISO, start the container (or the build container, when different from the base) with repos support, meaning it has network access and the secrets are bind mounted from the host. In all other cases, we now start the container with no network and without explicitly bind mounting
/run/secrets/. Note that secrets are still implicitly bind mounted by podman in its default configuration when running image-builder or bootc-image-builder outside a container.