From 01339127e818a6514eb111064c5d0a3c736f9bf8 Mon Sep 17 00:00:00 2001 From: "W. Trevor King" Date: Fri, 24 Aug 2018 14:17:55 -0700 Subject: [PATCH 1/2] hack: Add :z to --volume mounts Like we did in bootkube.sh in 0fa4eb13 (Fix perm errors with selinux enabled, 2018-08-15, #134). This gives us permission to access the mounted volume when SELinux is enabled (docs in [1]). I've also normalized these invocations for consistency between the various hack/ scripts: * Adding slash separators to put each option on its own line, excepting the final command being run in the container. This makes the long commands slightly easier to skim. It will also make it easier to track down motivation for an option with 'git blame', because commits touching options on other lines won't clutter the blame. * Use long-form options (-v -> --volume, etc.). This makes the options a bit more accessible to newcomers, and now that each option is on it's own line we have plenty of space. * Dropped single quotes from 'TRUE'. There are no shell-sensitive characters in TRUE, so there's no need to quote it. * Use ${PWD} consistently. It's in POSIX [2], so there's no need to execute a pwd process to get this value. * Drop -t. None of these commands should need a pseudoterminal. * Drop explicit rw --volume options. They're the default [3]. [1]: https://github.com/containers/libpod/blame/v0.8.3/docs/podman-run.1.md#L628 [2]: http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_03 [3]: https://github.com/containers/libpod/blame/v0.8.3/docs/podman-run.1.md#L646 --- hack/go-lint.sh | 10 ++++++---- hack/go-vet.sh | 7 ++++++- hack/shellcheck.sh | 7 ++++++- hack/test-bazel-build-tarball.sh | 8 +++++++- hack/tf-fmt.sh | 8 +++++++- hack/tf-lint.sh | 7 ++++++- hack/yaml-lint.sh | 7 ++++++- 7 files changed, 44 insertions(+), 10 deletions(-) diff --git a/hack/go-lint.sh b/hack/go-lint.sh index f0b5f1fa9b7..972b8efdd6a 100755 --- a/hack/go-lint.sh +++ b/hack/go-lint.sh @@ -4,9 +4,11 @@ if [ "$IS_CONTAINER" != "" ]; then golint -set_exit_status "${@}" else - docker run --rm --env IS_CONTAINER='TRUE' \ - -v "$PWD":/go/src/github.com/openshift/installer \ - -w /go/src/github.com/openshift/installer \ - --entrypoint sh quay.io/coreos/golang-testing \ + docker run --rm \ + --env IS_CONTAINER=TRUE \ + --volume "${PWD}:/go/src/github.com/openshift/installer:z" \ + --workdir /go/src/github.com/openshift/installer \ + --entrypoint sh \ + quay.io/coreos/golang-testing \ ./hack/go-lint.sh "${@}" fi diff --git a/hack/go-vet.sh b/hack/go-vet.sh index cc016fef0f7..4351e4ff9b0 100755 --- a/hack/go-vet.sh +++ b/hack/go-vet.sh @@ -2,5 +2,10 @@ if [ "$IS_CONTAINER" != "" ]; then go vet "${@}" else - docker run --rm --env IS_CONTAINER='TRUE' -v "$PWD":/go/src/github.com/openshift/installer -w /go/src/github.com/openshift/installer quay.io/coreos/golang-testing ./hack/go-vet.sh "${@}" + docker run --rm \ + --env IS_CONTAINER=TRUE \ + --volume "${PWD}:/go/src/github.com/openshift/installer:z" \ + --workdir /go/src/github.com/openshift/installer \ + quay.io/coreos/golang-testing \ + ./hack/go-vet.sh "${@}" fi; diff --git a/hack/shellcheck.sh b/hack/shellcheck.sh index 1b553ba7c79..33d35e53c47 100755 --- a/hack/shellcheck.sh +++ b/hack/shellcheck.sh @@ -6,5 +6,10 @@ if [ "$IS_CONTAINER" != "" ]; then -o -path "${TOP_DIR}/.build" -prune \ -o -type f -name '*.sh' -exec shellcheck --format=gcc {} \+ else - docker run -e IS_CONTAINER='TRUE' --rm -v "$(pwd)":/workdir:ro --entrypoint sh quay.io/coreos/shellcheck-alpine:v0.5.0 /workdir/hack/shellcheck.sh /workdir; + docker run --rm \ + --env IS_CONTAINER=TRUE \ + --volume "${PWD}:/workdir:ro,z" \ + --entrypoint sh \ + quay.io/coreos/shellcheck-alpine:v0.5.0 \ + /workdir/hack/shellcheck.sh /workdir fi; diff --git a/hack/test-bazel-build-tarball.sh b/hack/test-bazel-build-tarball.sh index 625cbbbce4e..6e05f104311 100755 --- a/hack/test-bazel-build-tarball.sh +++ b/hack/test-bazel-build-tarball.sh @@ -3,5 +3,11 @@ if [ "$IS_CONTAINER" != "" ]; then set -x bazel --output_base=/tmp build "$@" tarball else - docker run -e IS_CONTAINER='TRUE' --rm -v "$PWD":"$PWD" -v /tmp:/tmp:rw -w "$PWD" quay.io/coreos/tectonic-builder:bazel-v0.3 ./hack/test-bazel-build-tarball.sh + docker run --rm \ + --env IS_CONTAINER=TRUE \ + --volume "${PWD}:${PWD}:z" \ + --volume /tmp:/tmp:z \ + --workdir "${PWD}" \ + quay.io/coreos/tectonic-builder:bazel-v0.3 \ + ./hack/test-bazel-build-tarball.sh fi diff --git a/hack/tf-fmt.sh b/hack/tf-fmt.sh index 5cc9151f750..dc4f6e3b885 100755 --- a/hack/tf-fmt.sh +++ b/hack/tf-fmt.sh @@ -5,5 +5,11 @@ if [ "$IS_CONTAINER" != "" ]; then set -x /terraform fmt -list -check -write=false else - docker run -e IS_CONTAINER='TRUE' --rm -v "$PWD":"$PWD":ro -v /tmp:/tmp:rw -w "$PWD" quay.io/coreos/terraform-alpine:v0.11.7 ./hack/tf-fmt.sh + docker run --rm \ + --env IS_CONTAINER=TRUE \ + --volume "${PWD}:${PWD}:ro,z" \ + --volume /tmp:/tmp:z \ + --workdir "${PWD}" \ + quay.io/coreos/terraform-alpine:v0.11.7 \ + ./hack/tf-fmt.sh fi diff --git a/hack/tf-lint.sh b/hack/tf-lint.sh index 6c04df04647..2291682b027 100755 --- a/hack/tf-lint.sh +++ b/hack/tf-lint.sh @@ -2,5 +2,10 @@ if [ "$IS_CONTAINER" != "" ]; then tflint else - docker run -t --rm -v "$(pwd)":/data --env IS_CONTAINER='TRUE' --entrypoint sh quay.io/coreos/tflint ./hack/tf-lint.sh + docker run --rm \ + --env IS_CONTAINER=TRUE \ + --volume "${PWD}:/data:z" \ + --entrypoint sh \ + quay.io/coreos/tflint \ + ./hack/tf-lint.sh fi; diff --git a/hack/yaml-lint.sh b/hack/yaml-lint.sh index a8f144bcb58..36f0e17dd3b 100755 --- a/hack/yaml-lint.sh +++ b/hack/yaml-lint.sh @@ -2,5 +2,10 @@ if [ "$IS_CONTAINER" != "" ]; then yamllint --config-data "{extends: default, rules: {line-length: {level: warning, max: 120}}}" ./examples/ ./installer/ else - docker run -t --rm -v "$(pwd)":/workdir --env IS_CONTAINER='TRUE' --entrypoint sh quay.io/coreos/yamllint ./hack/yaml-lint.sh + docker run --rm \ + --env IS_CONTAINER=TRUE \ + --volume "${PWD}:/workdir:z" \ + --entrypoint sh \ + quay.io/coreos/yamllint \ + ./hack/yaml-lint.sh fi; From 4ba649b150219f8da550a314c171bcdd32f58865 Mon Sep 17 00:00:00 2001 From: "W. Trevor King" Date: Mon, 27 Aug 2018 11:03:30 -0700 Subject: [PATCH 2/2] hack: Drop /tmp mounts Eric points out potential issues with relabeling /tmp [1], which is shared by several system-level consumers. For the Bazel script, the /tmp mount is just since c483f597 (Move bazel build tarball test to prow, 2018-08-08, #117), so we can drop it to return to our previous approach. The Terraform container seems to run fine without /tmp as well, although there's no clear history to point to on this front because we used to use Bazel for this. See b8a9bbc5 (Remove bazel from test process, 2018-08-01, #97). [1]: https://github.com/openshift/installer/pull/174#discussion_r212764528 --- hack/test-bazel-build-tarball.sh | 1 - hack/tf-fmt.sh | 1 - 2 files changed, 2 deletions(-) diff --git a/hack/test-bazel-build-tarball.sh b/hack/test-bazel-build-tarball.sh index 6e05f104311..de84fca03cb 100755 --- a/hack/test-bazel-build-tarball.sh +++ b/hack/test-bazel-build-tarball.sh @@ -6,7 +6,6 @@ else docker run --rm \ --env IS_CONTAINER=TRUE \ --volume "${PWD}:${PWD}:z" \ - --volume /tmp:/tmp:z \ --workdir "${PWD}" \ quay.io/coreos/tectonic-builder:bazel-v0.3 \ ./hack/test-bazel-build-tarball.sh diff --git a/hack/tf-fmt.sh b/hack/tf-fmt.sh index dc4f6e3b885..e9ab0659249 100755 --- a/hack/tf-fmt.sh +++ b/hack/tf-fmt.sh @@ -8,7 +8,6 @@ else docker run --rm \ --env IS_CONTAINER=TRUE \ --volume "${PWD}:${PWD}:ro,z" \ - --volume /tmp:/tmp:z \ --workdir "${PWD}" \ quay.io/coreos/terraform-alpine:v0.11.7 \ ./hack/tf-fmt.sh