[NO TESTS NEEDED] Disable docker and alias to podman in FCOS ignition

[n1hility]

This PR disables the docker.sock systemd unit and sets up an overlay to replace /usr/bin/docker with a symlink to podman as discussed in [1]. A future PR will add support for dial-stdio, which would result in docker compatibility for those using docker cli ssh connections (not the local proxy/forwarding approach which is handled differently).

[1] #11643 (comment)

[NO TESTS NEEDED] since this is specific to podman machine(no testing infra yet)

Signed-off-by: Jason Greene [email protected]

[baude]

/approve

[baude]

LGTM

[rhatdan]

Any reason to not link docker.sock -> podman.sock?

[mheon]

/lgtm
/hold

If we want the link, that seems like a reasonable followon PR

[Luap99]

Do we really want an overlay fs over /usr/bin? Could this have unwanted side effects, e.g updates no longer working.
This also breaks the strict coreos file system layout, https://docs.fedoraproject.org/en-US/fedora-coreos/storage/#_mounted_filesystems

[n1hility]

Do we really want an overlay fs over /usr/bin? Could this have unwanted side effects, e.g updates no longer working.
This also breaks the strict coreos file system layout, https://docs.fedoraproject.org/en-US/fedora-coreos/storage/#_mounted_filesystems

I assumed it wouldn't, but this could be a faulty assumption. I'll see if I can check (unless someone else who knows FCOS better than me knows off the top of their head).

The overlay is the only way I know of to do this without relying on a custom FCOS build, since it's part of the base stream and the FS is read-only. I assume we don't want to go the route of a custom build since it would require maintaining a new stream.

[n1hility]

Actually, I might also be able to do this with overrides and just pull the package.

[n1hility]

Spoke with FCOS devs if they had any other suggestions:

They don't have a great solution to this problem, but do plan to address it in the future. The following options exist today

1. OverlayFS like in this PR- they said it's safe across updates but recommended 2 or 3 instead. It can get overridden if someone sshs in and does rpm-ostree usroverlay
2. Bind mount (e.g. mount --bind /usr/bin/podman /usr/bin/docker
3. Pull the package via overrides and a runonce systemd approach like I mentioned above, that will work post-updates
4. Do 3 but also install podman-docker. They recommended against layering because it will add network fetches all over the place.

I'll do a revision that goes with approach 3.

BTW I also asked about filesystem conventions, and both /opt and /usr/local are linked from var, so within policy.

[n1hility]

Any reason to not link docker.sock -> podman.sock?

done

I'll do a revision that goes with approach 3.

and done :)

[rhatdan]

LGTM

[rhatdan]

@baude @Luap99 @dustymabe PTAL

[TomSweeneyRedHat]

LGTM, but definitely want a head nod from one or more of the folks @rhatdan called out.

[dustymabe]

requested a few changes. As mentioned you'll need to use systemd-tmpfiles for the socket symlink. Here's the butane config I was using recently when testing this:

variant: fcos
version: 1.3.0
storage:
  files:
    - path: /etc/tmpfiles.d/podman-docker.conf
      mode: 0644
      contents:
        inline: |
          # Create a symlink from the docker socket to the podman socket.
          # Taken from https://github.com/containers/podman/blob/main/contrib/systemd/system/podman-docker.conf
          L+  /run/docker.sock   -    -    -     -   /run/podman/podman.sock
systemd:
  units:
    - name: docker.service
      enabled: false
      mask: true
    - name: docker.socket
      enabled: false
      mask: true
    - name: podman.socket
      enabled: true

[dustymabe]

Some requested changes.. Also do we need to explicitly enable podman.socket? At least on my system it's not enabled (but my system is an old system).

[n1hility]

Some requested changes.. Also do we need to explicitly enable podman.socket? At least on my system it's not enabled (but my system is an old system).

Thanks @dustymabe, applied those. Podman sock is already enabled here:

podman/pkg/machine/ignition.go

Line 115 in b3307bc

Enabled: boolToPtr(true),

[dustymabe]

Not necessarily for this PR, but note that network-online.target doesn't work for user units.. See

• generated systemd unit files need to pull in network-online.target #10655 (comment)
• RFE: monitor system units from user manager systemd/systemd#3312 (comment)

[dustymabe]

LGTM

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: baude, dustymabe, n1hility

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [baude]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhatdan]

/lgtm
/hold cancel