Integrate podman in Oniro (!204) · Merge requests · Eclipse Projects / Oniro Core / Oniro

Merged Andrei Gherzan requested to merge agherzan/oniro:ag/podman into kirkstone 2 years ago

Aug 16, 2022

oniro-mounts: Fix minor typo · e7cc3eae
Andrei Gherzan authored 2 years ago
```
Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
```
e7cc3eae

podman: Order rootless sysctl configuration · 65ce6825

Andrei Gherzan authored 2 years ago


Oniro disables user namespaces by default. We want podman be able to
override it (re-enable it) when rootless mode is enabled.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

65ce6825

oniro-sysctl: Use a priority number for sysctl conf files · cab2e790

Andrei Gherzan authored 2 years ago


Having a priority number makes it easier to order other configurations
for achiving overriding results.
This also cleans up a bit the recipe (FILES not needed, formatting
etc.).

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

cab2e790

oniro-mounts: The recipe is requiring systemd so depend on its distro feature · a65e3e1e

Andrei Gherzan authored 2 years ago


This is done using the features_check bbclass that checks for the distro
features in REQUIRED_DISTRO_FEATURES.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

a65e3e1e

docs: Add documentation on containers topic · 74484b36
Andrei Gherzan authored 2 years ago
```
Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
```
74484b36

oniro-linux.conf: Include DISTRO as part of the hostname · 1441ca5d

Andrei Gherzan authored 2 years ago


This gives a bit more clarity on what is running on a system without
sacrificing on flexibility.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

1441ca5d

oniro-image-common.inc: Include the containers packagegroup · 5f882e36

Andrei Gherzan authored 2 years ago


This will start pulling in the containers software stack in our
reference images.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

5f882e36

packagegroup-containers: Define a package group for the containers software stack · bac2d7a0
Andrei Gherzan authored 2 years ago
```
Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
```
bac2d7a0
podman: Have writable access to root network configuration · 15961e1f
Andrei Gherzan authored 2 years ago
```
Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
```
15961e1f
oniro-packageconfig.inc: Enable rootless support in podman · b24c6678
Andrei Gherzan authored 2 years ago
```
Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>
```
b24c6678

oniro-mounts: Have the entire /home mounted from appdata · ff2f282d

Andrei Gherzan authored 2 years ago

This offers the ability to have persistent data for features that
requires user data: for example running podman in rootless mode.
This change also makes sure that the home directory of user 'oniro'
exists on the appdata partition (using systemd tmpfiles).

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

ff2f282d

skopeo: Add oniro-specific configuration · 77d350f8

Andrei Gherzan authored 2 years ago


Skopeo is the component that podman uses to comunicate with container
registries so we configure skopeo for the OS requirements of the
project.

The most notable change is that we use the application partition for the
root's graphroot. This is where the data (including images) is stored
for the root user.

We also explicitly set the storage driver and runtime directory.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

77d350f8

oniro-linux.conf: Avoid removing shadow for ro filesystems · c3a92bc2

Andrei Gherzan authored 2 years ago


There are files in shadow (for example subid files) that are required at
runtime too - for example for podman rootless support. Make sure this
package is not removed even when disto/image is dealing with a ro
rootfs.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

c3a92bc2

oniro-image.bbclass: Add rootfs function for cleaning up subid backup files · d7ce8aa9

Andrei Gherzan authored 2 years ago

Podman requires subids configuration[1] but when creating them, shadow
does it using backup files. Clean them up too if available.

[1] https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md#etcsubuid-and-etcsubgid-configuration



Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

d7ce8aa9

shadow: Enable subid support · c9af7ceb

Andrei Gherzan authored 2 years ago


shadow utils are used when creating users at image creation time. The
useradd/usermod tools will only try to add a default configuration for
subid files if they exist. subid files are needed for podman rootless
support.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

c9af7ceb

oniro-linux.conf: Add virtualization distro feature · dd7cf5b9

Andrei Gherzan authored 2 years ago


The meta-virtualization layer gets enabled via a distro feature and
given that we now rely on its components for the Oniro containers
software stack, we enable it by default.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

dd7cf5b9

bblayers.conf.sample: Add meta-virtualization layer · 5b8b3948

Andrei Gherzan authored 2 years ago


Oniro relies on this layer for containers support.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

5b8b3948

default.xml: Add meta-virtualization layer · 4f2cf855

Andrei Gherzan authored 2 years ago


Oniro relies on this layer for containers support.

Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com>

4f2cf855

Integrate podman in Oniro

Merge request reports

Activity