slimtoolkit / slimtoolkit/slim
Building in a privileged mode
Open
Nobody has claimed this yet.
triage
- Dominant language
- Go
- Stars
- 23.4k
- Forks
- 840
- PR merge metrics
- No merged PRs in 30d
Description
Expected Behavior
docker-slim build supports --privileged mode, like docker run.
Actual Behavior
docker slim build runs a container in a non-privileged mode which means systemctl and systemd services don't work, e.g.:
❯ docker-slim build --target myimage --http-probe=false --exec "sudo systemctl status"
docker-slim: message='join the Gitter channel to ask questions or to share your feedback' info='https://gitter.im/docker-slim/community'
docker-slim: message='join the Discord server to ask questions or to share your feedback' info='https://discord.gg/9tDyxYS'
docker-slim: message='Github discussions' info='https://github.com/docker-slim/docker-slim/discussions'
cmd=build info=exec message='changing continue-after from probe to nothing because http-probe is disabled'
cmd=build info=exec message='updating continue-after mode to exec'
cmd=build state=started
cmd=build info=params target='myimage' continue.mode='exec' rt.as.user='true' keep.perms='true' tags=''
cmd=build state=image.inspection.start
cmd=build info=image id='sha256:4d0dea302c83b62d0421f240110d5d63b820483c9bdac71fb16a0379cab41022' size.bytes='11744295317' size.human='12 GB'
cmd=build info=image.stack index='0' name='myimage:0.2.0' id='sha256:4d0dea302c83b62d0421f240110d5d63b820483c9bdac71fb16a0379cab41022'
cmd=build state=image.inspection.done
cmd=build state=container.inspection.start
cmd=build info=container id='b5a51e04160cf9c865959be1d84c9c8cbe2edbad93d4bc7975245d2c73a8f330' status='created' name='dockerslimk_18146_20210708131249'
cmd=build info=cmd.startmonitor status='sent'
cmd=build info=event.startmonitor.done status='received'
cmd=build info=container name='dockerslimk_18146_20210708131249' id='b5a51e04160cf9c865959be1d84c9c8cbe2edbad93d4bc7975245d2c73a8f330' target.port.list='55041,55038,55039,55040' target.port.info='80/tcp => 0.0.0.0:55041,8080/tcp => 0.0.0.0:55038,4224/tcp => 0.0.0.0:55039,443/tcp => 0.0.0.0:55040' message='YOU CAN USE THESE PORTS TO INTERACT WITH THE CONTAINER'
cmd=build info=continue.after mode='exec' message='provide the expected input to allow the container inspector to continue its execution'
cmd=build info=continue.after mode='exec' shell='sudo systemctl status'
docker-slim[build][exec]: output: Failed to get D-Bus connection: Operation not permitted
cmd=build info=continue.after mode='exec' exitcode='1'
cmd=build state=container.inspection.finishing
cmd=build info=continue.after mode='exec' message='fatal: exec cmd failure'
cmd=build state=exited code=1
docker-slim: message='join the Gitter channel to ask questions or to share your feedback' info='https://gitter.im/docker-slim/community'
docker-slim: message='join the Discord server to ask questions or to share your feedback' info='https://discord.gg/9tDyxYS'
docker-slim: message='Github discussions' info='https://github.com/docker-slim/docker-slim/discussions'
Any systemctl commands returns this error:
docker-slim[build][exec]: output: Failed to get D-Bus connection: Operation not permitted
Steps to Reproduce the Problem
- Pull the
centos:8image - Run
docker-slim build --target centos --exec "systemctl status"
Specifications
- Version: docker-slim version darwin|Transformer|1.36.1|d8f2be23d44bf9f96c5f1f7e970c739106d17996|2021-06-21_03:24:08AM
- Platform: macOS
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the docker-slim build command with the centos:8 image and systemctl status, then trace the build command's container-creation path and its runtime options. Compare that behavior with Docker's --privileged mode. Done means privileged builds can run systemctl without the reported D-Bus permission error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100