NO-JIRA: fix: add rootless podman runtime setup to cryptoscan commands script - #83037
NO-JIRA: fix: add rootless podman runtime setup to cryptoscan commands script#83037fracappa wants to merge 1 commit into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@fracappa: This pull request explicitly references no jira issue. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fracappa The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
WalkthroughThe cryptoscan command script now initializes rootless Podman. It creates missing user and group entries, configures subordinate ID ranges, and writes registry and VFS storage settings. ChangesRootless Podman setup
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh`:
- Line 22: Update the setup around the containers configuration directory to
ensure rootless Podman receives the pull secret through a supported
authentication path before any Podman commands run. Use REGISTRY_AUTH_FILE, pass
the auth file explicitly, or copy the secret to ${HOME}/.docker/config.json, and
ensure the configured path matches the checked-in entrypoint path.
- Around line 23-30: Update the Podman registry configuration in the heredoc to
set short-name-mode to enforcing instead of permissive. Replace any unqualified
image references used by this script with fully qualified registry, repository,
and tag or digest references; define explicit aliases only where short names are
required.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 049eb240-d9a5-4c38-a89a-c7956905fa0d
📒 Files selected for processing (1)
ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh
| echo "${PODMAN_USER}:${PODMAN_START_ID}:${PODMAN_END_ID}" > /etc/subuid | ||
| echo "${PODMAN_USER}:${PODMAN_START_ID}:${PODMAN_END_ID}" > /etc/subgid | ||
|
|
||
| mkdir -p "${HOME}/.config/containers" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 4 \
'\.pull-secret\.json|REGISTRY_AUTH_FILE|--authfile|auth\.json|\b(podman|buildah|skopeo)\b' \
scripts \
ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh || trueRepository: openshift/release
Length of output: 3095
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== step command file =="
cat -n ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh
echo
echo "== entrypoint file =="
if [ -f ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/scripts/auto-rebase/rebase_job_entrypoint.sh ]; then
echo "FOUND"
cat -n ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/scripts/auto-rebase/rebase_job_entrypoint.sh
else
echo "MISSING"
fi
echo
echo "== related rebase scripts =="
fd -i 'rebase|token|registry|auth|podman' ci-operator/scripts ci-operator/step-registry/openshift/microshift/rebase 2>/dev/null || true
echo
echo "== focused search =="
rg -n -C 3 \
'\b(rebase_job_entrypoint|fetch_tools|pull-secret|REGISTRY_AUTH_FILE|--authfile|auth\.json|podman|buildah|skopeo|polaris|secret).*' \
ci-operator/scripts ci-operator/step-registry/openshift/microshift 2>/dev/null || trueRepository: openshift/release
Length of output: 50373
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== step metadata/yaml relevant credentials =="
cat -n ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-ref.yaml
echo
cat -n ci-operator/step-registry/openshift/microshift/rebase/openshift-microshift-rebase-ref.yaml
echo
echo "== repo top-level scripts =="
git ls-files scripts/* scripts/auto-rebase/* 2>/dev/null | sed -n '1,120p'
echo
echo "== exact entrypoint paths in repo =="
git ls-files | rg 'scripts/auto-rebase/rebase_job_entrypoint\.sh|fetch_tools\.sh|cryptoscan|microshift-rebase' | sed -n '1,200p'Repository: openshift/release
Length of output: 3732
🌐 Web query:
Podman authfile default XDG_RUNTIME_DIR containers auth.json fallback $HOME/.docker/config.json REGISTRY_AUTH_FILE
💡 Result:
In Podman, the authentication file mechanism is designed to handle credentials for registry access with specific default behaviors and fallback logic [1][2]. Default Authentication File Location On Linux, the default path for reading and writing authentication credentials is ${XDG_RUNTIME_DIR}/containers/auth.json [1][3][4]. Because XDG_RUNTIME_DIR is typically located in /run (an ephemeral directory), credentials stored here are not persistent across system reboots [1][5][6]. On macOS and Windows, the default path is
Citations:
- 1: https://docs.podman.io/en/stable/markdown/podman-login.1.html
- 2: https://docs.podman.io/en/stable/markdown/podman-run.1.html
- 3: https://docs.podman.io/en/v5.7.1/markdown/podman-login.1.html
- 4: https://manpages.debian.org/trixie/podman/podman-login.1.en.html
- 5: auth token default lookup paths - podman login man page XDG_RUNTIME_DIRECTORY seems inconsitent podman-container-tools/podman#26189
- 6: https://manpages.debian.org/unstable/podman-docker/docker-login.1.en.html
- 7: https://docs.podman.io/en/v5.3.2/markdown/podman-login.1.html
- 8: Regression in 4.4 and 4.5: podman login can no longer be used with docker-compose podman-container-tools/podman#18617
Verify the rootless Podman authentication handoff.
${HOME}/.pull-secret.json is not a Podman default path, and the checked-in entrypoint path is missing. If the rootless Podman toolchain runs before this secret is copied, private registry pulls can fail unless REGISTRY_AUTH_FILE is set, --authfile is passed for each Podman invocation, or ${HOME}/.docker/config.json is used as the Docker fallback.
[operational_advice]
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh`
at line 22, Update the setup around the containers configuration directory to
ensure rootless Podman receives the pull secret through a supported
authentication path before any Podman commands run. Use REGISTRY_AUTH_FILE, pass
the auth file explicitly, or copy the secret to ${HOME}/.docker/config.json, and
ensure the configured path matches the checked-in entrypoint path.
| cat > "${HOME}/.config/containers/registries.conf" <<PODMAN_EOF | ||
| unqualified-search-registries = [ | ||
| "registry.access.redhat.com", | ||
| "registry.redhat.io", | ||
| "docker.io" | ||
| ] | ||
| short-name-mode = "permissive" | ||
| PODMAN_EOF |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 4 \
'\b(podman|buildah|skopeo)\b' \
scripts \
ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh || trueRepository: openshift/release
Length of output: 1662
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== file outline / relevant sections =="
sed -n '1,220p' ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh
echo
echo "== image references and registry aliases in step registry dirs =="
rg -n 'short-name-mode|registries\.conf|unqualified-search-registries|alias|microshift|podman|buildah|skopeo|imagepull|quay|registry\.access\.redhat\.com|registry\.redhat\.io|docker\.io' ci-operator/step-registry/openshift/microshift/rebase -S || true
echo
echo "== deterministic short-name alias/order behavior in step script by static parse =="
python3 - <<'PY'
from pathlib import Path
p = Path('ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh')
s = p.read_text()
start = s.index('PODMAN_EOF')
print(s[start:start+300])
for tool in ['podman','buildah','skopeo']:
print(f'uses {tool}:', tool in s)
idx = s.find(tool)
if idx >= 0:
lines=s[idx:idx+300].splitlines()
print('line near first usage:', lines[0])
PYRepository: openshift/release
Length of output: 8618
🌐 Web query:
Podman registries.conf unqualified-search-registries short-name-mode permissive enforcing aliases
💡 Result:
In Podman, the configuration of container registry lookups is managed within the registries.conf file [1][2]. When a container image is pulled using a "short name" (an image reference that does not include a registry domain, such as ubi10 instead of registry.access.redhat.com/ubi10), Podman resolves the image using the following mechanisms [3][4]: Aliases The [aliases] table in registries.conf maps short names directly to fully qualified image references [1][2]. If a matching alias is found, Podman uses it immediately, bypassing the unqualified-search-registries list [3][5]. Aliases provide administrators with control over image sources, helping to prevent potential spoofing risks [1][2]. If both a manual configuration and a machine-generated alias file exist, the machine-generated file has precedence [3][1][5]. Unqualified-search-registries This is a list of registries that Podman queries in order when a short name is used and no alias is found [1][6]. If multiple registries are listed, Podman attempts to pull from them sequentially until the image is found [4][6]. Short-name-mode This setting defines how Podman handles ambiguity when a short name is not aliased and multiple registries are configured in unqualified-search-registries [3][4]. The three modes are [1][4]: enforcing: If no alias exists and more than one search registry is configured, Podman prompts the user to select a registry if running in an interactive terminal (TTY) [3][1]. If non-interactive (e.g., in a CI/CD pipeline), Podman will return an error to prevent ambiguous or insecure pulls [3][4]. If the pull succeeds, the choice is saved as an alias for future use [1][2]. permissive: Behaves like enforcing when interactive (prompts the user and records the alias) [3][4]. However, if non-interactive, Podman does not error; instead, it falls back to the legacy behavior of searching all configured unqualified-search-registries in order [3][1]. No alias is recorded in this mode [1][2]. disabled: Podman ignores alias matching and always searches all configured registries in the order specified [1][4]. This reflects the behavior of older versions of Podman [4]. By default, if short-name-mode is not specified, it defaults to permissive mode [3][5]. New installations are often configured to use enforcing mode to enhance security [4].
Citations:
- 1: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/building_running_and_managing_containers/working-with-container-registries
- 2: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/building_running_and_managing_containers/working-with-container-registries_building-running-and-managing-containers
- 3: https://man.archlinux.org/man/containers-registries.conf.5.en
- 4: https://www.redhat.com/en/blog/container-image-short-names
- 5: https://manpages.debian.org/unstable/buildah/containers-registries.conf.5.en.html
- 6: https://www.redhat.com/en/blog/manage-container-registries
Do not allow permissive short-name image resolution.
With unqualified-search-registries = ["registry.access.redhat.com", "registry.redhat.io", "docker.io"] and short-name-mode = "permissive", a non-interactive Podman image pull for an unqualified short name uses the next configured registry when the first registry is unavailable. CI image sources should not depend on fallback lookup order. Use fully qualified image references and change the mode to enforcing; add explicit aliases if short names are required.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh`
around lines 23 - 30, Update the Podman registry configuration in the heredoc to
set short-name-mode to enforcing instead of permissive. Replace any unqualified
image references used by this script with fully qualified registry, repository,
and tag or digest references; define explicit aliases only where short names are
required.
|
Closing in favor of: openshift/microshift#7051 |
2 participants
Summary by CodeRabbit
The MicroShift rebase cryptoscan CI command now supports rootless Podman execution. It creates missing user and group entries, configures subordinate UID and GID ranges, and writes registry and VFS storage settings in the user home directory.