[CI:DOCS] podman machine: enforce a single search registry

[vrothberg]

Enforce "docker.io" to be the only search registry. Short-name
resolution for remote clients is not fully supported since there is no
means to prompt. Enforcing a single registry works around the problem
since prompting only fires with more than one search registry.

Fixes: #11489
Signed-off-by: Valentin Rothberg [email protected]

CI:DOCS since machine isn't yet tested in CI.

/hold
... to make sure everyone's on board.

[Luap99]

I think this should be done via the ignition file, https://github.com/containers/podman/blob/main/pkg/machine/ignition.go

[rhatdan]

Also is it possible to only do this iff the machine is set in enforcing mode?

[vrothberg]

I think this should be done via the ignition file, https://github.com/containers/podman/blob/main/pkg/machine/ignition.go

Good idea!

Also is it possible to only do this iff the machine is set in enforcing mode?

Via ignition, I am absolutely not sure. But even via SSH it'll be tough since the short-name mode is not exposed in podman info. Since there may be config files at various places, we shouldn't guess.

[vrothberg]

Now done via ignition

[vrothberg]

@containers/podman-maintainers @mtrmac PTAL

[rhatdan]

I know nothing about ingition, so can not comment.
@dustymabe PTAL

[rhatdan]

@miabbott PTAL

[mtrmac]

The code LGTM.

Why the CI:DOCS? (I don’t care very much at all what policy Podman chooses for testing incoming PRs; I find it very irritating to see it routinely bypassed. Should this be fully tested? If this is intentional and consistent with the project’s policy, it would be nice to update CONTRIBUTING.md to match.)

[mtrmac]

Why the CI:DOCS?

I can’t be bothered to read, it seems:

CI:DOCS since machine isn't yet tested in CI.

I apologize.

[mtrmac]

Should podman machine document this somewhere?

[miabbott]

Also is it possible to only do this iff the machine is set in enforcing mode?

Via ignition, I am absolutely not sure. But even via SSH it'll be tough since the short-name mode is not exposed in podman info. Since there may be config files at various places, we shouldn't guess.

Ignition does not have a native way of reacting to a configured state or even a configuration included in an Ignition config.

https://coreos.github.io/ignition/rationale/#ignition-configs-are-declarative

Ignition configs do not allow users to provide arbitrary logic (including scripts for Ignition to run). Users describe which filesystems must exist, which files must be created, which users must exist, and etc. Any further customization must use systemd services, created by Ignition.

If you wanted a change to only be applied when SELinux is enforcing, you'd have to write a systemd unit that can detect the condition and apply the change.

[rhatdan]

Ok let's go with this solution for now, and then modify it once we have prompting capabilities.

[giuseppe]

LGTM

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, vrothberg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [giuseppe,vrothberg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[vrothberg]

Updated. PTanotherL.

I'll be on PTO next week. In case this PR is still open and more requests fly in, feel free to kick it over the finish line.

[rhatdan]

/lgtm

[rhatdan]

/hold cancel