Repository navigation
fix(container): update image quay.io/podman/stable (7b5e95b ➔ d29c7fd) - #6831
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
@@ metadata.annotations.actions.github.com/values-hash @@
# actions.github.com/v1alpha1/AutoscalingRunnerSet/actions-runner-system/rsume-runner
! ± value change
- 96b3fec6f1773a7f5a243b316016539b0ceb77ac1f4722f69aa4de3ae0afdcb
+ 8cf7e3d3543f76a2d40ba56e54fdc90533767325dbb014fcec76e12525d9058
@@ spec.template.spec.initContainers.podman.image @@
# actions.github.com/v1alpha1/AutoscalingRunnerSet/actions-runner-system/rsume-runner
! ± value change
- quay.io/podman/stable:v6.1.3@sha256:7b5e95b4934dde2d367b949c47a68f3705ca21e077fb27ed9a5b4fb8b01b9008
+ quay.io/podman/stable:v6.1.3@sha256:d29c7fdd99acee4990e8e9f3e097fcb82b06f2ffeb44bdf2aa76230e6b5a690d |
@@ spec.values.template.spec.initContainers.podman.image @@
# helm.toolkit.fluxcd.io/v2/HelmRelease/actions-runner-system/rsume-runner
! ± value change
- quay.io/podman/stable:v6.1.3@sha256:7b5e95b4934dde2d367b949c47a68f3705ca21e077fb27ed9a5b4fb8b01b9008
+ quay.io/podman/stable:v6.1.3@sha256:d29c7fdd99acee4990e8e9f3e097fcb82b06f2ffeb44bdf2aa76230e6b5a690d |
|
Tip Routine: only container-image and chart-version changes; 1 resource across 1 app
konflate 0.6.6 · rendered |
![tanguille-cluster[bot]](https://avatars.githubusercontent.com/u/91473554?s=60&v=4){kind=small}
| # Native sidecar. | ||
| - name: podman | ||
| image: quay.io/podman/stable:v6.1.3@sha256:7b5e95b4934dde2d367b949c47a68f3705ca21e077fb27ed9a5b4fb8b01b9008 | ||
| image: quay.io/podman/stable:v6.1.3@sha256:d29c7fdd99acee4990e8e9f3e097fcb82b06f2ffeb44bdf2aa76230e6b5a690d |
There was a problem hiding this comment.
Same tag, different build: d29c7fd is built from image_build commit 646441e (merge of PR #71), which moved mount_program/mountopt from [storage.overlay] to [storage.options.overlay] in /etc/containers/storage.rootless.conf.d/20-image_build.conf (podman/Containerfile lines 104-111 at that commit). The digest being replaced was built with the wrong table, so mount_program was ignored — image_build#70 reproduces that against quay.io/podman/stable:v6.1.3 (overlay.mount_program absent from podman info -f '{{.Store.GraphOptions}}').
Those drop-ins are read for uid 1001 (container-libs storage/pkg/configfile/parse.go, getDropInPaths adds /etc/containers/storage.rootless.conf.d; the ConfigMap only overrides containers.conf via CONTAINERS_CONF_OVERRIDE, never storage), so after this bump rootless Podman picks up mount_program = "/usr/bin/fuse-overlayfs". The sidecar has no /dev/fuse: the rendered pod (lines 87-109 here, flate build hr rsume-runner) mounts just podman-home, podman-sock, work and podman-ids, holds only SETUID/SETGID, and is not privileged. fuse-overlayfs cannot mount without that device, so the first docker run/docker build a job runs through the socket fails with fuse: device not found, while the podman info startup probe keeps passing and Flux reports the pod healthy. image_build#73 (open, filed against the build this digest ships) reports exactly this regression for a container-embedded Podman.
report each breaking change, deprecation, rename or changed default that affects it, and any version it must stay in lockstep with
Suggested fix
Two ways out, pick one and prove it with a job before the digest lands:
- Give the sidecar the device — add a
hostPath: /dev/fusevolume (typeCharDevice) mounted at/dev/fusein thepodmancontainer (needs the fuse module on the Talos nodes). - Keep the previous effective storage config: add a
storage.confkey torsume-runner-podmaninconfigmap.yaml([storage]\ndriver = "overlay"\n[storage.options]\nadditionalimagestores = ["/var/lib/shared"]— nomount_program), mount it at/etc/containers/storage.conf(subPathstorage.conf), and setCONTAINERS_STORAGE_CONF=/etc/containers/storage.confin the sidecar env, which skips the image's drop-ins.
Then run a job that does docker run --rm alpine true (or the rsume image build) on the new pod and confirm it mounts rather than erroring.
Prompt for a coding agent
In kubernetes/apps/actions-runner-system/actions-runner-controller/runners/rsume/, make the Podman sidecar able to mount after the image rebuild that enables fuse-overlayfs.
Prefer the storage-override route: in configmap.yaml add a `storage.conf` data key under `rsume-runner-podman` with:
[storage]
driver = "overlay"
[storage.options]
additionalimagestores = ["/var/lib/shared"]
Then in helmrelease.yaml, under the `podman` sidecar, add env `CONTAINERS_STORAGE_CONF: /etc/containers/storage.conf` and a volumeMount for volume `podman-ids` at mountPath `/etc/containers/storage.conf` with subPath `storage.conf`.
Alternatively add a `dev-fuse` volume (`hostPath: {path: /dev/fuse, type: CharDevice}`) and mount it at `/dev/fuse` in the same container if the nodes have the fuse module; do not do both.
Leave the image pinned to quay.io/podman/stable:v6.1.3@sha256:d29c7fdd99acee4990e8e9f3e097fcb82b06f2ffeb44bdf2aa76230e6b5a690d.
Verify by rendering with `flate build hr rsume-runner -n actions-runner-system -p kubernetes` and by running `docker run --rm alpine true` through the socket in a rsume-runner job.
This PR contains the following updates:
7b5e95b→d29c7fdConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate CLI.