-
Notifications
You must be signed in to change notification settings - Fork 4.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
change to volume mount, add SELinux label #16241
base: main
Are you sure you want to change the base?
Conversation
6495db0
to
45bb8f4
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #16241 +/- ##
===========================================
+ Coverage 45.36% 66.16% +20.79%
===========================================
Files 244 1048 +804
Lines 13333 114471 +101138
Branches 2719 2856 +137
===========================================
+ Hits 6049 75737 +69688
- Misses 6983 34588 +27605
- Partials 301 4146 +3845
Flags with carried forward coverage won't be shown. Click here to find out more. |
Just did an update from 2.4.1 to 2.5 and the process reminded me to check on this PR. Is there anything I can help you guys with? |
This PR is being marked stale due to a period of inactivty. If this PR is still relevant, please comment or remove the stale label. Otherwise, this PR will close in 30 days. |
@goharbor/all-maintainers, I think it would make sense to have this feature in Harbor. what do you think? |
This makes lots of sense to me. |
This PR is being marked stale due to a period of inactivty. If this PR is still relevant, please comment or remove the stale label. Otherwise, this PR will close in 30 days. |
Any news on this one? Would really make my life easier during updates if you could accept this change ^-^ |
Mark this as "help needed" because we would like to get some help (advice, concerns) from the experts who are working on SELinux. |
@stonezdj - can you please provide info as we spoke on the call Thank you so much! |
Previously we are using the mount volume, and found an issue which will create a folder if the directory doesn't exist, and cause subsequent issues in container. to avoid this issue, we changed it to bind type, if the directory is not found, it fails to start with docker-compose |
The problem with a bind mount on an SELinux enabled system is that SELinux will block this approach and the startup will fail as it triggers an SELinux AVC. The only way a bind mount will work - at least on Fedora/CoreOS, RHEL, openSUSE MicroOS since those are the ones I tested ^-^ - is if the user manually relabels the folders that are bind mounted with Right now if I update our Harbor instance I have to edit out all the bind mounts, and replace them with the volume mount and relabel options. The |
@apinter thanks for the details, @stonezdj @YangJiao0817 can we validate this PR both on ubuntu and SELinux(Fedora/CoreOS or RHEL or openSUSE MicroOS)? |
Hi @apinter Can you rebase this PR? |
45bb8f4
to
72958d9
Compare
not stale |
72958d9
to
699db5b
Compare
Last week I rebased the PR, just a gentle push ^-^ |
This PR is being marked stale due to a period of inactivty. If this PR is still relevant, please comment or remove the stale label. Otherwise, this PR will close in 30 days. |
@apinter Is the work on this still in progress? |
Wow it has been a hot minute... Totally forgot to keep track :/ |
@apinter that will be great :) |
521b32c
to
d25f355
Compare
@OrlinVasilev rebased and updated. |
@apinter are you still interested in that? |
👋 |
can you please address the comments from @stonezdj |
@apinter also if you can please the DCO thank you! |
@apinter please go ahead to continue working on this PR and let me mark it as a candidate of v2.13 since we've reached the FC of v2.12, and no new code changes but issue resolve will be accepted. |
4a7c84e
to
98c2aec
Compare
@OrlinVasilev @wy65701436 sorry I took a bit. Rebased, checked, signed off, should be good to go ;) |
Signed-off-by: Attila Pinter <[email protected]>
Signed-off-by: Attila Pinter <[email protected]>
8461b95
to
06b3b69
Compare
This PR supposed to fix issues on distributions with SELinux - like this one - by changing all
bind mounts
tovolume mounts
in thedocker-compose.yml.jinja
file and adding the SELinux labels to them. Labels and modes are ignored by Dockerbind mounts
. This way the generateddocker-compose.yaml
files not require modifications by the user.