Test: Build the ubi stack image using tool: jam

[cmoulliard]

Test case

Test to build the ubi stack images (run/build) for each stack: java, nodejs, etc using as tool: jam

Status: NOK - see report stack-test-30-aug-2024
Repo: https://github.com/paketo-community/ubi-base-stack
Tool: jam
Container tool: podman
OS: rhel9

Steps to reproduce:

• ssh to a rhel9 VM
• Install podman, git, curl, wget
• Install jam
• Start podman: systemctl --user start podman.socket
• Login to docker.io podman login -u <username> -p <password> docker.io
• Export export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock
• Command executed within the git repo: jam create-stack --config stack.toml --build-output build --run-output build - see bash script

[cmoulliard]

See issue: paketo-buildpacks/jam#345

[BarDweller]

Unable to recreate..

+ cat /etc/fedora-release
Fedora release 39 (Thirty Nine)
+ podman --version
podman version 4.9.5
+ export DOCKER_HOST=unix:///run/user/1000/podman/podman.sock
+ DOCKER_HOST=unix:///run/user/1000/podman/podman.sock
+ systemctl --user start podman.socket
+ systemctl --user status podman.socket
● podman.socket - Podman API Socket
     Loaded: loaded (/usr/lib/systemd/user/podman.socket; enabled; preset: disabled)
     Active: active (listening) since Wed 2024-09-04 09:32:13 EDT; 2h 21min ago
   Triggers: ● podman.service
       Docs: man:podman-system-service(1)
     Listen: /run/user/1000/podman/podman.sock (Stream)
     CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/podman.socket

Sep 04 09:32:13 PODMANVM systemd[1033131]: Listening on podman.socket - Podman API Socket.
+ ./jam-linux-amd64 version
jam 2.9.0
+ git clone https://github.com/paketo-community/ubi-base-stack
Cloning into 'ubi-base-stack'...
remote: Enumerating objects: 758, done.
remote: Counting objects: 100% (480/480), done.
remote: Compressing objects: 100% (230/230), done.
remote: Total 758 (delta 324), reused 333 (delta 237), pack-reused 278 (from 1)
Receiving objects: 100% (758/758), 505.21 KiB | 4.11 MiB/s, done.
Resolving deltas: 100% (406/406), done.
+ cd ubi-base-stack
+ cp images.json stack
+ cd stack
+ ../../jam-linux-amd64 create-stack --config stack.toml --build-output build --run-output run
Building io.buildpacks.stacks.ubi8
  Building on linux/amd64
    Building base images
      Build complete for base images
    build: Decorating base image
      Adding CNB_* environment variables
      Adding io.buildpacks.stack.* labels
      Creating cnb user
    run: Decorating base image
      Adding io.buildpacks.stack.* labels
      Creating cnb user
      Updating /etc/os-release
    build: Updating image
    run: Updating image

  Exporting build image to build
  Exporting run image to run

[cmoulliard]

The workaround as documented here: containers/podman#3234 is to do:

sudo setenforce 0

[cmoulliard]

Question posted to Brian Cook : Are we allowed to do sudo setenforce 0 on the remote RHEL 9 VM ?
@brianwcook

[BarDweller]

Are the RHEL/Centos VMs broken in some manner?

I have selinux enabled on the host I ran the above on, and it worked fine.. (Fedora Workstation 39)

$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
$ getenforce
Enforcing

[cmoulliard]

On RHEL9

[cloud-user@rhel-9 stack]$ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33