Silverblue toolbox script broke because rootless 'podman create' insists on having a command specified

[debarshiray]

/kind bug

Description

Here is the toolbox script that we have been working on for Fedora Silverblue.

If you follow the README.md until the fedora-toolbox create step, then you'll see that the podman create ... command fails:

$ ./fedora-toolbox --verbose create
...
...
No command specified on command line or as CMD or ENTRYPOINT in this image
./fedora-toolbox: failed to create container fedora-toolbox-rishi:28

This started happening somewhere between podman-0.8.5 and podman-0.9.1.

Changing the script like this solves the problem:

From 79ac919f63f90b4cf2b425d2e3221d86c44ccb7c Mon Sep 17 00:00:00 2001
From: Debarshi Ray <[email protected]>
Date: Wed, 12 Sep 2018 14:57:38 +0200
Subject: [PATCH] Make it work with newer podman

'podman create ...' now requires a command.
---
 fedora-toolbox | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fedora-toolbox b/fedora-toolbox
index a918ed484cdc..5861c615d70e 100755
--- a/fedora-toolbox
+++ b/fedora-toolbox
@@ -97,7 +97,8 @@ create()
                  --tty \
                  --volume $HOME:$HOME \
                  --volume $XDG_RUNTIME_DIR:$XDG_RUNTIME_DIR \
-                 $toolbox_image >/dev/null 2>&42; then
+                 $toolbox_image \
+                 /bin/sh --l >/dev/null 2>&42; then
         echo "$0: failed to create container $toolbox_container"
         exit 1
     fi
-- 
2.17.1

Is this a podman regression? Or is this a bug in the toolbox script that was somehow getting papered over in previous podman versions, and should be fixed in the script?

Output of podman version:

Version:       0.9.1
Go Version:    go1.10.4
OS/Arch:       linux/amd64

Output of podman info:

host:
  Conmon:
    package: podman-0.9.1-3.gitaba58d1.fc28.x86_64
    path: /usr/libexec/podman/conmon
    version: 'conmon version 1.12.0-dev, commit: 1d75f1d54e9e123a97e7f505e38df7ab7192cfa7-dirty'
  MemFree: 10339491840
  MemTotal: 16696360960
  OCIRuntime:
    package: runc-1.0.0-51.dev.gitfdd8055.fc28.x86_64
    path: /usr/bin/runc
    version: 'runc version spec: 1.0.0'
  SwapFree: 4208979968
  SwapTotal: 4208979968
  arch: amd64
  cpus: 4
  hostname: bollard
  kernel: 4.17.19-200.fc28.x86_64
  os: linux
  uptime: 10m 51.89s
insecure registries:
  registries: []
registries:
  registries:
  - docker.io
  - registry.fedoraproject.org
  - quay.io
  - registry.access.redhat.com
  - registry.centos.org
store:
  ContainerStore:
    number: 0
  GraphDriverName: vfs
  GraphOptions: []
  GraphRoot: /var/home/rishi/.local/share/containers/storage
  GraphStatus: {}
  ImageStore:
    number: 3
  RunRoot: /run/user/1000/run

Additional environment details (AWS, VirtualBox, physical, etc.):

This is a physical laptop running Fedora 28 Silverblue 28.20180908.0

[mheon]

@giuseppe PTAL

[mheon]

I think I know what's going on here - create is presently wired to not create a user namespace, which I think means it can't use the c/storage store to fetch the image and determine the command/entrypoint

[giuseppe]

yes, we should avoid the command/entrypoint before podman is re-executed. I think this patch could fix it:

diff --git a/cmd/podman/create.go b/cmd/podman/create.go
index bc010d04..5a1b7425 100644
--- a/cmd/podman/create.go
+++ b/cmd/podman/create.go
@@ -629,7 +629,7 @@ func parseCreateOpts(ctx context.Context, c *cli.Context, runtime *libpod.Runtim
                command = append(command, data.ContainerConfig.Cmd...)
        }
 
-       if len(command) == 0 {
+       if data != nil && len(command) == 0 {
                return nil, errors.Errorf("No command specified on command line or as CMD or ENTRYPOINT in this image")
        }
 
@@ -681,7 +681,7 @@ func parseCreateOpts(ctx context.Context, c *cli.Context, runtime *libpod.Runtim
        }
 
        var systemd bool
-       if c.BoolT("systemd") && ((filepath.Base(command[0]) == "init") || (filepath.Base(command[0]) == "systemd")) {
+       if command != nil && c.BoolT("systemd") && ((filepath.Base(command[0]) == "init") || (filepath.Base(command[0]) == "systemd")) {
                systemd = true
                if signalString == "" {
                        stopSignal, err = signal.ParseSignal("RTMIN+3")

@debarshiray do you have any chance to test it out? I'll prepare a proper PR and test it better if can confirm it solves the issue for you

[rhatdan]

@giuseppe Could you open a PR?

[pkubatrh]

Running into this as well via rootless podman run ...

[giuseppe]

PR opened here: #1472

[debarshiray]

Yes, #1472 works for me! Thanks.