Prevent incompatable upgrade of crypto-policies (elastic#82475)

An upgrade of crypto-policies is incompatible with libnss as it removes `/usr/bin/update-crypto-policies` being used. A follow-up issue has been created to track removing this pinning elastic#82474 Signed-off-by: Tiago Costa <[email protected]> Signed-off-by: Tyler Smalley <[email protected]>
tylersmalley · Nov 3, 2020 · ee06366 · ee06366
1 parent 9de2b86
commit ee06366
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/src/dev/build/tasks/os_packages/docker_generator/templates/Dockerfile b/src/dev/build/tasks/os_packages/docker_generator/templates/Dockerfile
@@ -43,7 +43,17 @@ RUN chmod -R g=u /usr/share/kibana
 FROM {{{baseOSImage}}}
 EXPOSE 5601
 
+{{#ubi}}
+  # https://github.com/rpm-software-management/microdnf/issues/50
+  RUN mkdir -p /run/user/$(id -u)
+
+  # crypto-policies not currently compatible with libnss :sadpanda:
+  RUN printf "[main]\nexclude=crypto-policies" >  /etc/dnf/dnf.conf
+{{/ubi}}
+
 RUN for iter in {1..10}; do \
+      # update microdnf to have exclusion feature for dnf configuration
+      {{packageManager}} update microdnf --setopt=tsflags=nodocs -y && \
       {{packageManager}} update --setopt=tsflags=nodocs -y && \
       {{packageManager}} install --setopt=tsflags=nodocs -y \
         fontconfig freetype shadow-utils libnss3.so {{#ubi}}findutils{{/ubi}} && \