Build Custom RHEL UBI Container

[KRI3G]

• Choose UBI image: ubi9/ubi (multi-service, supports systemd)

• Create Containerfile to:

• Install openssh-server

• Add ContainerSSH agent binary

• Configure systemd to run sshd and containerssh-agent

• Set up non-root user with /home/$USER

• Validate SSH + agent functionality inside container

• Push image to internal or public registry (e.g. Docker Hub, GHCR) Will build from Containerfile

[KRI3G]

By using Red Hat UBIs, you do enter into this agreement. Be sure to read it https://www.redhat.com/licenses/EULA_Red_Hat_Universal_Base_Image_English_20190422.pdf

[KRI3G]

Nice documentation on UBI images and how to build from them using tools like podman and builah https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/building_running_and_managing_containers/index#assembly_types-of-container-images_building-running-and-managing-containers

[KRI3G]

Some packages/features to add to the final image:

• sudo
• bash-completion
• ncurses
• custom PS1 (and maybe a skel for new user home dirs?)

[KRI3G]

Make sure to run this before running containers on SELinux enabled systems
setsebool -P container_manage_cgroup 1

[KRI3G]

I used podman and buildah to build the student container image. Maybe we should use Podman to run the containerssh config, auth, and ssh servers and build the containers in a Gitops style using a webhook?

[KRI3G]

ContainerSSH seems to be failing on trying to use a locally accessible/built image. Will investigate

On further thought, I might just push student-guest images to quay.io

[KRI3G]

Docker seems to be unable to run the ubi9-init image but Podman can. Trying to switch to use podman as the backend

[KRI3G]

having to deal with podman rootless issues is getting annoying. Plan is to likely make a containerssh image myself that is easier to work with a containessh user on the host, or smth similar