slimtoolkit / slimtoolkit/slim

Building in a privileged mode

Open
#212 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

triage
Dominant language
Go
Stars
23.4k
Forks
840
PR merge metrics
No merged PRs in 30d

Description

Expected Behavior

docker-slim build supports --privileged mode, like docker run.


Actual Behavior

docker slim build runs a container in a non-privileged mode which means systemctl and systemd services don't work, e.g.:

❯ docker-slim build --target myimage --http-probe=false --exec "sudo systemctl status"
docker-slim: message='join the Gitter channel to ask questions or to share your feedback' info='https://gitter.im/docker-slim/community'
docker-slim: message='join the Discord server to ask questions or to share your feedback' info='https://discord.gg/9tDyxYS'
docker-slim: message='Github discussions' info='https://github.com/docker-slim/docker-slim/discussions'
cmd=build info=exec message='changing continue-after from probe to nothing because http-probe is disabled'
cmd=build info=exec message='updating continue-after mode to exec'
cmd=build state=started
cmd=build info=params target='myimage' continue.mode='exec' rt.as.user='true' keep.perms='true' tags=''
cmd=build state=image.inspection.start
cmd=build info=image id='sha256:4d0dea302c83b62d0421f240110d5d63b820483c9bdac71fb16a0379cab41022' size.bytes='11744295317' size.human='12 GB'
cmd=build info=image.stack index='0' name='myimage:0.2.0' id='sha256:4d0dea302c83b62d0421f240110d5d63b820483c9bdac71fb16a0379cab41022'
cmd=build state=image.inspection.done
cmd=build state=container.inspection.start
cmd=build info=container id='b5a51e04160cf9c865959be1d84c9c8cbe2edbad93d4bc7975245d2c73a8f330' status='created' name='dockerslimk_18146_20210708131249'
cmd=build info=cmd.startmonitor status='sent'
cmd=build info=event.startmonitor.done status='received'
cmd=build info=container name='dockerslimk_18146_20210708131249' id='b5a51e04160cf9c865959be1d84c9c8cbe2edbad93d4bc7975245d2c73a8f330' target.port.list='55041,55038,55039,55040' target.port.info='80/tcp => 0.0.0.0:55041,8080/tcp => 0.0.0.0:55038,4224/tcp => 0.0.0.0:55039,443/tcp => 0.0.0.0:55040' message='YOU CAN USE THESE PORTS TO INTERACT WITH THE CONTAINER'
cmd=build info=continue.after mode='exec' message='provide the expected input to allow the container inspector to continue its execution'
cmd=build info=continue.after mode='exec' shell='sudo systemctl status'
docker-slim[build][exec]: output: Failed to get D-Bus connection: Operation not permitted
cmd=build info=continue.after mode='exec' exitcode='1'
cmd=build state=container.inspection.finishing
cmd=build info=continue.after mode='exec' message='fatal: exec cmd failure'
cmd=build state=exited code=1
docker-slim: message='join the Gitter channel to ask questions or to share your feedback' info='https://gitter.im/docker-slim/community'
docker-slim: message='join the Discord server to ask questions or to share your feedback' info='https://discord.gg/9tDyxYS'
docker-slim: message='Github discussions' info='https://github.com/docker-slim/docker-slim/discussions'

Any systemctl commands returns this error:

docker-slim[build][exec]: output: Failed to get D-Bus connection: Operation not permitted

Steps to Reproduce the Problem

  1. Pull the centos:8 image
  2. Run docker-slim build --target centos --exec "systemctl status"

Specifications

  • Version: docker-slim version darwin|Transformer|1.36.1|d8f2be23d44bf9f96c5f1f7e970c739106d17996|2021-06-21_03:24:08AM
  • Platform: macOS

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the docker-slim build command with the centos:8 image and systemctl status, then trace the build command's container-creation path and its runtime options. Compare that behavior with Docker's --privileged mode. Done means privileged builds can run systemctl without the reported D-Bus permission error.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
cli, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.