From 06b72649779718fe7e41c3b91f44d7b056b12579 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 23 Oct 2023 13:29:30 -0400 Subject: [PATCH] Use buildah default isolation when working with podman play kube Users can specify BUILDAH_ISOLATION environment variable to change the default. Fixes: https://github.com/containers/podman/issues/20024 Currently podman play kube is defaulting to chroot, which is the least safe version of build, we should always default to secure whenever possible. Chroot should only be used when building within a container. No great way to tests this. [NO NEW TESTS NEEDED] Signed-off-by: Daniel J Walsh --- docs/source/markdown/podman-kube-play.1.md.in | 4 +++- pkg/domain/infra/abi/play.go | 7 ++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/docs/source/markdown/podman-kube-play.1.md.in b/docs/source/markdown/podman-kube-play.1.md.in index 8576e8e351..d7ffb1a5ae 100644 --- a/docs/source/markdown/podman-kube-play.1.md.in +++ b/docs/source/markdown/podman-kube-play.1.md.in @@ -163,6 +163,8 @@ and as a result environment variable `FOO` is set to `bar` for container `contai Build images even if they are found in the local storage. Use `--build=false` to completely disable builds. (This option is not available with the remote Podman client) +Note: You can also override the default isolation type by setting the BUILDAH_ISOLATION environment variable. export BUILDAH_ISOLATION=oci. See podman-build.1.md for more information. + @@option cert-dir #### **--configmap**=*path* @@ -320,4 +322,4 @@ has been changed or altered. @@include ../../kubernetes_support.md ## SEE ALSO -**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** +**[podman(1)](podman.1.md)**, **[podman-kube(1)](podman-kube.1.md)**, **[podman-kube-down(1)](podman-kube-down.1.md)**, **[podman-network-create(1)](podman-network-create.1.md)**, **[podman-kube-generate(1)](podman-kube-generate.1.md)**, **[podman-build(1)](podman-build.1.md)**, **[containers-certs.d(5)](https://github.com/containers/image/blob/main/docs/containers-certs.d.5.md)** diff --git a/pkg/domain/infra/abi/play.go b/pkg/domain/infra/abi/play.go index 0bfb12d1e8..cdf776596b 100644 --- a/pkg/domain/infra/abi/play.go +++ b/pkg/domain/infra/abi/play.go @@ -13,6 +13,7 @@ import ( "sync" buildahDefine "github.com/containers/buildah/define" + bparse "github.com/containers/buildah/pkg/parse" "github.com/containers/common/libimage" nettypes "github.com/containers/common/libnetwork/types" "github.com/containers/common/pkg/config" @@ -991,7 +992,11 @@ func (ic *ContainerEngine) getImageAndLabelInfo(ctx context.Context, cwd string, buildOpts := new(buildahDefine.BuildOptions) commonOpts := new(buildahDefine.CommonBuildOptions) buildOpts.ConfigureNetwork = buildahDefine.NetworkDefault - buildOpts.Isolation = buildahDefine.IsolationChroot + isolation, err := bparse.IsolationOption("") + if err != nil { + return nil, nil, err + } + buildOpts.Isolation = isolation buildOpts.CommonBuildOpts = commonOpts buildOpts.Output = container.Image buildOpts.ContextDirectory = filepath.Dir(buildFile)