[APIv2] building container with isolation=default started failing after #9246

[riyad]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

Trying to find regressions by exercising the APIv2 trough docker-py's test suite (see #5386) I came across a regressions in the BuildTest::test_build_isolation test.

Building containers with isolation=default started failing with commit 19507d0.

Steps to reproduce the issue:

cat > Dockerfile <<EOF
FROM scratch
CMD sh -c "echo \'Deaf To All But The Song\'
EOF

2. tar cf test.tar Dockerfile

3. curl -sS --unix-socket /var/run/user/1000/podman/podman.sock -XPOST 'http://localhost/v1.40/build?t=isolation&isolation=default' -H "Content-Type: application/tar" --data-binary '@test.tar'

Describe the results you received:

Run against commit 19507d0:

{"cause":"schema: error converting value for \"isolation\"","message":"schema: error converting value for \"isolation\"","response":400}

Describe the results you expected:

Run against commit 2bf1321:

{"stream":"STEP 1: FROM scratch\n"}
{"stream":"STEP 2: CMD sh -c \"echo \\'Deaf To All But The Song\\'\n"}
{"stream":"STEP 3: COMMIT isolation\n"}
{"stream":"Getting image source signatures\n"}
{"stream":"Copying blob sha256:4ca545ee6d5db5c1170386eeb39b2ffe3bd46e5d4a73a9acbebc805f19607eb3\n"}
{"stream":"Copying config sha256:fe9067e46ed83a50d10c196a74bed82e66fc11a714240b001f1e70c82d6eaec9\n"}
{"stream":"Writing manifest to image destination\n"}
{"stream":"Storing signatures\n"}
{"stream":"--\u003e fe9067e46ed\n"}
{"stream":"fe9067e46ed83a50d10c196a74bed82e66fc11a714240b001f1e70c82d6eaec9\n"}
{"stream":"Successfully built fe9067e46ed8\n"}

[mheon]

@rhatdan PTAL

[riyad]

FYI: this error is still happening in 25d8195

[riyad]

FYI: this error is still happening in c4a5513

[matejvasek]

@riyad
It's crashing because the handler is expecting decimal value for isolation.
We had similar issues with wait endpoint. @rhatdan is that isolation decimal deliberately, or might it have been hanged accidentally like wait conditions?

[matejvasek]

Another problem it that the valid value set is different for docker and libpod API.

const (
	// IsolationDefault is whatever we think will work best.
	IsolationDefault Isolation = iota
	// IsolationOCI is a proper OCI runtime.
	IsolationOCI
	// IsolationChroot is a more chroot-like environment: less isolation,
	// but with fewer requirements.
	IsolationChroot
	// IsolationOCIRootless is a proper OCI runtime in rootless mode.
	IsolationOCIRootless
)

versus

type Isolation string

// IsDefault indicates the default isolation technology of a container. On Linux this
// is the native driver. On Windows, this is a Windows Server Container.
func (i Isolation) IsDefault() bool {
	return strings.ToLower(string(i)) == "default" || string(i) == ""
}

// IsHyperV indicates the use of a Hyper-V partition for isolation
func (i Isolation) IsHyperV() bool {
	return strings.ToLower(string(i)) == "hyperv"
}

// IsProcess indicates the use of process isolation
func (i Isolation) IsProcess() bool {
	return strings.ToLower(string(i)) == "process"
}

https://docs.docker.com/engine/reference/commandline/build/#specify-isolation-technology-for-container---isolation

Is there any way how to map those values to each other?

[matejvasek]

I think that isolation is valid only for Windows daemons, so we can accept only default right?

[matejvasek]

@rhatdan now I see it's probably new param to build, unlike the wait condition parameter.

[mheon]

Honestly, it would be simpler to just be ignore it completely for the Compat endpoint - no validation or errors.

This is an unfortunate case where the parameter means entirely different things for Libpod and Compat.

[matejvasek]

I locally fixed the isolation issue, now I got the very same problem with networkmode.

[guss77]

I locally fixed the isolation issue, now I got the very same problem with networkmode.

@matejvasek - was the "networkmode" value issue ever solved? I'm also getting this in docker build with Podman 3.0.1 on Ubuntu 21.04.

[matejvasek]

was the "networkmode" value issue ever solved? I'm also getting this in docker build with Podman 3.0.1 on Ubuntu 21.04.

@guss77 what is reproducer for this? What does Dockerfile looks like? What CLI flags do you use?

[matejvasek]

OK I can reproduce it on 3.0.1. On main it also fails but not because of networkmode but because of auth headers.

[matejvasek]

It seems to work with 3.2.3 could you please verify @guss77 ?

[matejvasek]

@guss77 try installing from kubic https://podman.io/getting-started/installation#ubuntu

[guss77]

It seems to work with 3.2.3 could you please verify @guss77 ?

Indeed - installing 3.2.3 from kubic solves the networkmode issue with the docker CLI.

[matejvasek]

@guss77 note that build might be broken again in some new release #11235