[rhel-9.6] OCPBUGS-82523: passwd & group: Add containers user & group#236
Conversation
The openvswitch user and group have been part of the passwd & group files for, at least, as long as we've published RHCOS sources publicly: - https://github.com/openshift/os/blame/bdb5b8153ed68c88e2485d9e7bd66ea6eb54d6c1/passwd#L27 - https://github.com/openshift/os/blame/release-4.19/group#L47 We did not remove them when we re-visited our fixed UIDs/GID in the split between the RHEL boot image and the new OCP node image ([1], [2] & [3]). Thus they are now part of the base RHEL boot image, even though the openvswitch package is not included there. Although technically unnecessary, this is fine and simplify things a bit as we do not have to update the user & group entries during the node image build, which is currently a problematic topic (see [4]). Thus instead of adding openvswitch to hugetlbfs group in the node image build, we add it here directly to simplify the logic. [1] openshift/os#1661 [2] coreos#29 [3] coreos#31 [4] openshift/os#1917
Adding users and groups during a container image layered build is currently non-ergonomic with bootable containers. Thus instead of doing that in openshift/os for the node layer, we directly include the user & group here, which also guarentees us that the UID/GID remain stable. See openshift/os#1917 for the original version of this change and the full details about what makes adding user/group in the node layer non-ergonomic. Unfortunately we can not use the UID/GID that were used in the last "full" RHCOS image (4.18) as those are now used for dnsmasq (see [1]). Thus use the first UID & GID available for both user and group, going downward. [1] openshift/os#1917 (comment) Fixes: https://redhat.atlassian.net/browse/OCPBUGS-64841
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a new 'containers' user and group (ID 790) and updates the 'hugetlbfs' group to include the 'openvswitch' user. Feedback was provided regarding the 'containers' entry in the passwd file, recommending the use of the canonical /usr/sbin/nologin shell path and a more standard home directory like / to ensure consistency with other system accounts.
| nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin | ||
| ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin | ||
| avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin | ||
| containers:x:790:790:User for rootless containers:/nonexistent:/sbin/nologin |
There was a problem hiding this comment.
The shell path /sbin/nologin is inconsistent with the majority of system entries in this file (e.g., nobody, ceph, avahi-autoipd, dnsmasq, clevis) which use /usr/sbin/nologin. In RHEL 9, /usr/sbin/nologin is the preferred canonical path. Additionally, /nonexistent is not a standard home directory convention in RHEL; using / (consistent with the nobody user) or /var/empty is recommended for system accounts that do not require a home directory.
containers:x:790:790:User for rootless containers:/:/usr/sbin/nologin
travier
changed the title
|
@travier: This pull request references Jira Issue OCPBUGS-82523, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dustymabe, travier The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/jira refresh |
|
@travier: This pull request references Jira Issue OCPBUGS-82523, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
|
@travier: This pull request references Jira Issue OCPBUGS-82523, which is valid. The bug has been moved to the POST state. 5 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest |
|
@travier: Jira Issue OCPBUGS-82523: Some pull requests linked via external trackers have merged: The following pull request, linked via external tracker, has not merged:
All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with Jira Issue OCPBUGS-82523 has not been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
3 participants
Backport of #224
group: Add openvswitch to hugetlbfs group
The openvswitch user and group have been part of the passwd & group
files for, at least, as long as we've published RHCOS sources publicly:
We did not remove them when we re-visited our fixed UIDs/GID in the
split between the RHEL boot image and the new OCP node image ([1], [2] &
[3]). Thus they are now part of the base RHEL boot image, even though
the openvswitch package is not included there.
Although technically unnecessary, this is fine and simplify things a bit
as we do not have to update the user & group entries during the node
image build, which is currently a problematic topic (see [4]).
Thus instead of adding openvswitch to hugetlbfs group in the node image
build, we add it here directly to simplify the logic.
[1] openshift/os#1661
[2] #29
[3] #31
[4] openshift/os#1917
passwd & group: Add containers user & group
Adding users and groups during a container image layered build is
currently non-ergonomic with bootable containers. Thus instead of doing
that in openshift/os for the node layer, we directly include the user &
group here, which also guarentees us that the UID/GID remain stable.
See openshift/os#1917 for the original version
of this change and the full details about what makes adding user/group
in the node layer non-ergonomic.
Unfortunately we can not use the UID/GID that were used in the last
"full" RHCOS image (4.18) as those are now used for dnsmasq (see [1]).
Thus use the first UID & GID available for both user and group, going
downward.
[1] openshift/os#1917 (comment)
Fixes: https://redhat.atlassian.net/browse/OCPBUGS-64841