NO-JIRA: fix: add rootless podman runtime setup to cryptoscan commands script #83037
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,6 +6,33 @@ if [[ "$JOB_NAME" == rehearse* ]]; then | |
| export DRY_RUN=y | ||
| fi | ||
|
|
||
| # Setup rootless podman (mirrors nested-podman entrypoint.sh) | ||
| if ! whoami &> /dev/null; then | ||
| if [ -w /etc/passwd ]; then | ||
| echo "${USER_NAME:-user}:x:$(id -u):0:${USER_NAME:-user} user:${HOME}:/bin/bash" >> /etc/passwd | ||
| echo "${USER_NAME:-user}:x:$(id -u):" >> /etc/group | ||
| fi | ||
| fi | ||
| PODMAN_USER=$(whoami) | ||
| PODMAN_START_ID=$(( $(id -u)+1 )) | ||
| PODMAN_END_ID=$(( 65536-PODMAN_START_ID )) | ||
| echo "${PODMAN_USER}:${PODMAN_START_ID}:${PODMAN_END_ID}" > /etc/subuid | ||
| echo "${PODMAN_USER}:${PODMAN_START_ID}:${PODMAN_END_ID}" > /etc/subgid | ||
|
|
||
| mkdir -p "${HOME}/.config/containers" | ||
| cat > "${HOME}/.config/containers/registries.conf" <<PODMAN_EOF | ||
| unqualified-search-registries = [ | ||
| "registry.access.redhat.com", | ||
| "registry.redhat.io", | ||
| "docker.io" | ||
| ] | ||
| short-name-mode = "permissive" | ||
| PODMAN_EOF | ||
|
Comment on lines
+23
to
+30
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
rg -n -C 4 \
'\b(podman|buildah|skopeo)\b' \
scripts \
ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh || trueRepository: openshift/release Length of output: 1662 🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
echo "== file outline / relevant sections =="
sed -n '1,220p' ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh
echo
echo "== image references and registry aliases in step registry dirs =="
rg -n 'short-name-mode|registries\.conf|unqualified-search-registries|alias|microshift|podman|buildah|skopeo|imagepull|quay|registry\.access\.redhat\.com|registry\.redhat\.io|docker\.io' ci-operator/step-registry/openshift/microshift/rebase -S || true
echo
echo "== deterministic short-name alias/order behavior in step script by static parse =="
python3 - <<'PY'
from pathlib import Path
p = Path('ci-operator/step-registry/openshift/microshift/rebase/cryptoscan/openshift-microshift-rebase-cryptoscan-commands.sh')
s = p.read_text()
start = s.index('PODMAN_EOF')
print(s[start:start+300])
for tool in ['podman','buildah','skopeo']:
print(f'uses {tool}:', tool in s)
idx = s.find(tool)
if idx >= 0:
lines=s[idx:idx+300].splitlines()
print('line near first usage:', lines[0])
PYRepository: openshift/release Length of output: 8618 🌐 Web query:
💡 Result: In Podman, the configuration of container registry lookups is managed within the registries.conf file [1][2]. When a container image is pulled using a "short name" (an image reference that does not include a registry domain, such as ubi10 instead of registry.access.redhat.com/ubi10), Podman resolves the image using the following mechanisms [3][4]: Aliases The [aliases] table in registries.conf maps short names directly to fully qualified image references [1][2]. If a matching alias is found, Podman uses it immediately, bypassing the unqualified-search-registries list [3][5]. Aliases provide administrators with control over image sources, helping to prevent potential spoofing risks [1][2]. If both a manual configuration and a machine-generated alias file exist, the machine-generated file has precedence [3][1][5]. Unqualified-search-registries This is a list of registries that Podman queries in order when a short name is used and no alias is found [1][6]. If multiple registries are listed, Podman attempts to pull from them sequentially until the image is found [4][6]. Short-name-mode This setting defines how Podman handles ambiguity when a short name is not aliased and multiple registries are configured in unqualified-search-registries [3][4]. The three modes are [1][4]: enforcing: If no alias exists and more than one search registry is configured, Podman prompts the user to select a registry if running in an interactive terminal (TTY) [3][1]. If non-interactive (e.g., in a CI/CD pipeline), Podman will return an error to prevent ambiguous or insecure pulls [3][4]. If the pull succeeds, the choice is saved as an alias for future use [1][2]. permissive: Behaves like enforcing when interactive (prompts the user and records the alias) [3][4]. However, if non-interactive, Podman does not error; instead, it falls back to the legacy behavior of searching all configured unqualified-search-registries in order [3][1]. No alias is recorded in this mode [1][2]. disabled: Podman ignores alias matching and always searches all configured registries in the order specified [1][4]. This reflects the behavior of older versions of Podman [4]. By default, if short-name-mode is not specified, it defaults to permissive mode [3][5]. New installations are often configured to use enforcing mode to enhance security [4]. Citations:
Do not allow permissive short-name image resolution. With 🤖 Prompt for AI Agents |
||
| cat > "${HOME}/.config/containers/storage.conf" <<PODMAN_EOF | ||
| [storage] | ||
| driver = "vfs" | ||
| PODMAN_EOF | ||
|
|
||
| export PATH="${HOME}/.local/bin:${PATH}" | ||
| python3 -m ensurepip --upgrade | ||
| pip3 install setuptools-rust cryptography pyyaml pygithub gitpython | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/release
Length of output: 3095
🏁 Script executed:
Repository: openshift/release
Length of output: 50373
🏁 Script executed:
Repository: openshift/release
Length of output: 3732
🌐 Web query:
Podman authfile default XDG_RUNTIME_DIR containers auth.json fallback $HOME/.docker/config.json REGISTRY_AUTH_FILE💡 Result:
In Podman, the authentication file mechanism is designed to handle credentials for registry access with specific default behaviors and fallback logic [1][2]. Default Authentication File Location On Linux, the default path for reading and writing authentication credentials is ${XDG_RUNTIME_DIR}/containers/auth.json [1][3][4]. Because XDG_RUNTIME_DIR is typically located in /run (an ephemeral directory), credentials stored here are not persistent across system reboots [1][5][6]. On macOS and Windows, the default path is$HOME/.config/containers/auth.json [1][2]. Fallback Logic When Podman requires authentication, it performs a search in the following order: 1. It first checks the file specified by the --authfile flag, if provided [1][7]. 2. If no authfile is specified, it looks for credentials in the default path: $ {XDG_RUNTIME_DIR}/containers/auth.json (on Linux) [1][2]. 3. If credentials are not found or are invalid in the default path, Podman falls back to checking $HOME/.docker/config.json, which is the standard configuration file used by Docker [1][4][2]. Note that this fallback is read-only; Podman does not write new credentials to the Docker config file [8]. Environment Variable Override You can override the default authentication file path by setting the REGISTRY_AUTH_FILE environment variable [3][7][2]. Setting this variable allows you to specify a persistent path or a custom location for your credentials [1][6]. Example of overriding the path: export REGISTRY_AUTH_FILE=$HOME/.config/containers/auth.json
Citations:
Verify the rootless Podman authentication handoff.
${HOME}/.pull-secret.jsonis not a Podman default path, and the checked-in entrypoint path is missing. If the rootless Podman toolchain runs before this secret is copied, private registry pulls can fail unlessREGISTRY_AUTH_FILEis set,--authfileis passed for each Podman invocation, or${HOME}/.docker/config.jsonis used as the Docker fallback.[operational_advice]
🤖 Prompt for AI Agents