389-ds-base

#50484 Add a release build dockerfile and dscontainer improvements
Closed by spichugi. Opened by firstyear.
firstyear/389-ds-base xxxxx-docker-minimise  into  master

Download 50484.patch

Bug Description: In testing a production deployment of 389-ds-base
from the source tree, a new dockerfile was added to handle the release
build and proper image cleanups. Additionally, some issues with sigchld
handling were noted.

Fix Description:
* Add a .release dockerfile for the suse base image which cleans up
after itself correctly.
* Catch extra arguments to the sigchld handler
* Create directories in /data with more open permissions to account for
id changes.

Author: William Brown william@blackhats.net.au

Review by: ???

rebased onto 5dc1b4d3ad1005389bc94ede7db19b69ef3db312

1 new commit added

  • Follow up to add dsrc support to containers

I believe the autoreconf -fiv && \ (and whatever there is in the %prep section in the SPEC file, if any) is missing before the ./configure .... I couldn't compile without this as the actual configure script hadn't been generated.

With this approach aren't we exposing the files on the host machine to whatever user has an access to that machine? Shouldn't we rather change owner to fit our usage?

Let's make the /data/config/container.inf path a constant as it's used all over the place.

Fixed autoreconf and the conftainer.inf constant.

About the files to the hostmachine - the host already has access to everything with every container. So this is not an issue because security in containers is provided by namespaces, not unix permissions.

1 new commit added

  • Update based on mhonek feedback

Fixed autoreconf and the conftainer.inf constant.

Thanks!

About the files to the hostmachine - the host already has access to everything with every container. So this is not an issue because security in containers is provided by namespaces, not unix permissions.

My concern was an unprivileged user on the host machine. But that should be handled by proper permissions on volume's directory, so this is kinda OK I guess.

Ack from me.

Yeah exactly, the volume dir above will protect it. Thanks for the review mate!

I'll squash and merge then :)

rebased onto 7f58c064b491d5dad152551f509dd159da747868

Pull-Request has been merged by firstyear

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/3541

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.

Pull-Request has been closed by spichugi
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.