Fedora packager environment in a docker container

[Michal Minar]

Did anyone successfully set up his fedora packaging environment in a docker
container?
I didn't get past `kinit miminar(a)FEDORAPROJECT.ORG` in a container. It
gives me:

Invalid UID in persistent keyring name while getting default ccache

I'd be very glad for any suggestion or advice. Until then, I'll stick with
a VM.

Regards,
-- 

MICHAL MINÁŘ

SOFTWARE ENGINEER

Red Hat Czech, s.r.o. <https://www.redhat.com/>

miminar(a)redhat.com
<https://red.ht/sig>

[Patrick Uiterwijk]

Hi,

On Mon, Apr 24, 2017 at 12:29 PM, Michal Minar <miminar(a)redhat.com&gt; wrote:

>  Did anyone successfully set up his fedora packaging environment in a
>  docker container?
>  
I didn't get past `kinit miminar(a)FEDORAPROJECT.ORG` in a container. It
>  gives me:
>
>  Invalid UID in persistent keyring name while getting default ccache
>  
This is caused because Docker installs a default seccomp policy that denies
access to the Kernel keyring because this is not namespaced.
You can work around this by "export KRB5CCNAME=/tmp/ticket".

Alternatively, you can allow the container access to your host keyring.
For this, you can start with my policy:
https://github.com/puiterwijk/development-environments/blob/master/docker...
.
This is based on Docker 1.13.
For the 1.12 and earlier version, grab:
https://github.com/puiterwijk/development-environments/blob/ed497fbbd5643...
.

Then on the docker run command, add: --security-opt
seccomp=$HOME/Documents/Development/Environments/docker/koji/policy.json

Do note that if you want to do kinit, you will want to add the add_key call
as well (I just do kinit on my workstation, and use the seccomp policy to
allow my koji container access to it).


>  I'd be very glad for any suggestion or advice. Until then, I'll stick with
>  a VM.
>
>  Regards,
>  --
>
>  MICHAL MINÁŘ
>
>  SOFTWARE ENGINEER
>
>  Red Hat Czech, s.r.o. <https://www.redhat.com/>
>
>  miminar(a)redhat.com
>
>  
Regards,
Patrick

[Daniel Walsh]

On 04/24/2017 08:08 AM, Patrick Uiterwijk wrote:
>  Hi,
>
>  On Mon, Apr 24, 2017 at 12:29 PM, Michal Minar <miminar(a)redhat.com&gt; wrote:
>
> > Did anyone successfully set up his fedora packaging environment in a
> > docker container?
> >
>  I didn't get past `kinit miminar(a)FEDORAPROJECT.ORG` in a container. It
> > gives me:
> >
> > Invalid UID in persistent keyring name while getting default ccache
> >
>  This is caused because Docker installs a default seccomp policy that denies
>  access to the Kernel keyring because this is not namespaced.
>  You can work around this by "export KRB5CCNAME=/tmp/ticket".
>
>  Alternatively, you can allow the container access to your host keyring.
>  For this, you can start with my policy:
>
> https://github.com/puiterwijk/development-environments/blob/master/docker...
SELinux would also block this, and if you have multiple containers 
running with the same UID it will not work, even if we took down SELinux 
and SECCOMP blocks.  The bottom line is there is only one kernel keyring 
per UID.  I have asked to make keyrings namespace aware, but right now 
the kernel guys believe usernamespace is the solution to this problem.

[Daniel Walsh]

On 04/24/2017 06:29 AM, Michal Minar wrote:
>  Did anyone successfully set up his fedora packaging environment in a
>
>  docker container?
>  I didn't get past `kinit miminar(a)FEDORAPROJECT.ORG 
>  <mailto:[e-mail]>` in a container. It gives me:
>
>  Invalid UID in persistent keyring name while getting default ccache
>
>  I'd be very glad for any suggestion or advice. Until then, I'll stick 
>  with a VM.
>
>  Regards,
>  -- 
>
>  MICHAL MINÁŘ
>
>  SOFTWARE ENGINEER
>
>  Red Hat Czech, s.r.o. <https://www.redhat.com/>
>
>  miminar(a)redhat.com <mailto:[e-mail]>
>
>  <https://red.ht/sig>
>
>
>
>  _______________________________________________
>  devel mailing list -- devel(a)lists.fedoraproject.org
>  To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org 
I think this is conflicting with the kernel keyring for the same UID.  
Attempt to do this without using the kernel keyring.  IE Setup kerberos 
to use a file based cache.

[Stephen Gallagher]

On 04/24/2017 08:47 AM, Daniel Walsh wrote:
>  On 04/24/2017 06:29 AM, Michal Minar wrote:
> > Did anyone successfully set up his fedora packaging environment in a
> > docker container?
> > I didn't get past `kinit miminar(a)FEDORAPROJECT.ORG
> > <mailto:[e-mail]>` in a container. It gives me:
> >
> > Invalid UID in persistent keyring name while getting default ccache
> >
> > I'd be very glad for any suggestion or advice. Until then, I'll stick
> > with a VM.
> >
> > Regards,
> > -- 
> >
> > MICHAL MINÁŘ
> >
> > SOFTWARE ENGINEER
> >
> > Red Hat Czech, s.r.o. <https://www.redhat.com/>
> >
> > miminar(a)redhat.com <mailto:[e-mail]>   
> >
> > <https://red.ht/sig>
> >
> >
> >
> > _______________________________________________
> > devel mailing list -- devel(a)lists.fedoraproject.org
> > To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
>
>  I think this is conflicting with the kernel keyring for the same UID. 
>  Attempt to do this without using the kernel keyring.  IE Setup
>  kerberos to use a file based cache.
>  

FYI, there is work ongoing to resolve issues like this without using the
kernel keyring but instead using a Kerberos KCM server inside of SSSD
which should be container-aware:
https://docs.pagure.org/SSSD.sssd/design_pages/kcm.html