Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-5328

OMR 1.3.3 does not install if SELinux is enforced

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • omr-v1.3.3
    • OMR
    • False
    • None
    • False
    • Critical
    • 0

      [root@ip-192-168-0-251 mirror-registry]# ./mirror-registry --version
      
         __   __
        /  \ /  \     ______   _    _     __   __   __
       / /\ / /\ \   /  __  \ | |  | |   /  \  \ \ / /
      / /  / /  \ \  | |  | | | |  | |  / /\ \  \   /
      \ \  \ \  / /  | |__| | | |__| | / ____ \  | |
       \ \/ \ \/ /   \_  ___/  \____/ /_/    \_\ |_|
        \__/ \__/      \ \__
                        \___\ by Red Hat
       Build, Store, and Distribute your Containers
      	
      mirror-registry version v1.3.3 

       

      [root@ip-192-168-0-251 mirror-registry]# ./mirror-registry -v --additionalArgs="-vvv" install
      __ __
      / \ / \ ______ _ _ __ __ __
      / /\ / /\ \ / __ \ | | | | / \ \ \ / /
      / / / / \ \ | | | | | | | | / /\ \ \ /
      \ \ \ \ / / | |_| | | |_| | / ____ \ | |
      \ \/ \ \/ / _ __/ __/ // _\ |_|
      _/ _/ \ __
      ___\ by Red Hat
      Build, Store, and Distribute your Containers
      INFO[2023-04-21 13:58:10] Install has begun 
      DEBU[2023-04-21 13:58:10] Ansible Execution Environment Image: quay.io/quay/mirror-registry-ee:latest 
      DEBU[2023-04-21 13:58:10] Pause Image: registry.access.redhat.com/ubi8/pause:8.7-6 
      DEBU[2023-04-21 13:58:10] Quay Image: registry.redhat.io/quay/quay-rhel8:v3.8.5 
      DEBU[2023-04-21 13:58:10] Redis Image: registry.redhat.io/rhel8/redis-6:1-92.1669834635 
      DEBU[2023-04-21 13:58:10] Postgres Image: registry.redhat.io/rhel8/postgresql-10:1-203.1669834630 
      INFO[2023-04-21 13:58:10] Found execution environment at /root/mirror-registry/execution-environment.tar 
      INFO[2023-04-21 13:58:10] Loading execution environment from execution-environment.tar 
      DEBU[2023-04-21 13:58:10] Importing execution enviornment with command: /bin/bash -c /usr/bin/podman image import \
      --change 'ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' \
      --change 'ENV HOME=/home/runner' \
      --change 'ENV container=oci' \
      --change 'ENTRYPOINT=["entrypoint"]' \
      --change 'WORKDIR=/runner' \
      --change 'EXPOSE=6379' \
      --change 'VOLUME=/runner' \
      --change 'CMD ["ansible-runner", "run", "/runner"]' \
      
      quay.io/quay/mirror-registry-ee:latest < /root/mirror-registry/execution-environment.tar
      Getting image source signatures
      Copying blob 0a047d54cb3f skipped: already exists 
      Copying config 016acf9804 done 
      Writing manifest to image destination
      Storing signatures
      sha256:016acf98047c3a0fd706bc68a9bfea8e441a68a5f5230be6cd6c3781086986c0
      INFO[2023-04-21 13:58:13] Detected an installation to localhost 
      INFO[2023-04-21 13:58:13] Found SSH key at /root/.ssh/quay_installer 
      INFO[2023-04-21 13:58:13] Attempting to set SELinux rules on /root/.ssh/quay_installer 
      INFO[2023-04-21 13:58:13] Found image archive at /root/mirror-registry/image-archive.tar 
      INFO[2023-04-21 13:58:13] Detected an installation to localhost 
      INFO[2023-04-21 13:58:13] Unpacking image archive from /root/mirror-registry/image-archive.tar 
      quay.tar
      redis.tar
      postgres.tar
      pause.tar
      INFO[2023-04-21 13:58:22] Loading pause image archive from pause.tar 
      DEBU[2023-04-21 13:58:22] Importing Pause with command: /bin/bash -c /usr/bin/podman image import \
      --change 'ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' \
      --change 'ENV container=oci' \
      --change 'ENTRYPOINT=["sleep"]' \
      --change 'CMD=["infinity"]' \ registry.access.redhat.com/ubi8/pause:8.7-6 < pause.tar
      Getting image source signatures
      Copying blob bd87c5e38685 skipped: already exists 
      Copying config 4a95eeb390 done 
      Writing manifest to image destination
      Storing signatures
      sha256:4a95eeb3904787740b1e03af50aa91166f733a472836c420518e6ed2dc4ab596
      INFO[2023-04-21 13:58:26] Loading redis image archive from redis.tar 
      DEBU[2023-04-21 13:58:26] Importing Redis with command: /bin/bash -c /usr/bin/podman image import \
      --change 'ENV PATH=/opt/app-root/src/bin:/opt/app-root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' \
      --change 'ENV container=oci' \
      --change 'ENV STI_SCRIPTS_URL=image:///usr/libexec/s2i' \
      --change 'ENV STI_SCRIPTS_PATH=/usr/libexec/s2i' \
      --change 'ENV APP_ROOT=/opt/app-root' \
      --change 'ENV HOME=/var/lib/redis' \
      --change 'ENV PLATFORM=el8' \
      --change 'ENV REDIS_VERSION=6' \
      --change 'ENV CONTAINER_SCRIPTS_PATH=/usr/share/container-scripts/redis' \
      --change 'ENV REDIS_PREFIX=/usr' \
      --change 'ENV REDIS_CONF=/etc/redis.conf' \
      --change 'ENTRYPOINT=["container-entrypoint"]' \
      --change 'USER=1001' \
      --change 'WORKDIR=/opt/app-root/src' \
      --change 'EXPOSE=6379' \
      --change 'VOLUME=/var/lib/redis/data' \
      --change 'CMD ["run-redis"]' \ registry.redhat.io/rhel8/redis-6:1-92.1669834635 < redis.tar
      Getting image source signatures
      Copying blob 7a06346e698d skipped: already exists 
      Copying config 2fc3dd5633 done 
      Writing manifest to image destination
      Storing signatures
      sha256:2fc3dd56333e234d2c9d4797f348606995dc499a9f626787fdecf0bcb24e52cb
      INFO[2023-04-21 13:58:30] Loading postgres image archive from postgres.tar 
      DEBU[2023-04-21 13:58:30] Importing Postgres with command: /bin/bash -c /usr/bin/podman image import \
      --change 'ENV PATH=/opt/app-root/src/bin:/opt/app-root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' \
      --change 'ENV STI_SCRIPTS_URL=image:///usr/libexec/s2i' \
      --change 'ENV STI_SCRIPTS_PATH=/usr/libexec/s2i' \
      --change 'ENV APP_ROOT=/opt/app-root' \
      --change 'ENV APP_DATA=/opt/app-root' \
      --change 'ENV HOME=/var/lib/pgsql' \
      --change 'ENV PLATFORM=el8' \
      --change 'ENV POSTGRESQL_VERSION=10' \
      --change 'ENV POSTGRESQL_PREV_VERSION=9.6' \
      --change 'ENV PGUSER=postgres' \
      --change 'ENV CONTAINER_SCRIPTS_PATH=/usr/share/container-scripts/postgresql' \
      --change 'ENTRYPOINT=["container-entrypoint"]' \
      --change 'WORKDIR=/opt/app-root/src' \
      --change 'EXPOSE=5432' \
      --change 'USER=26' \
      --change 'CMD ["run-postgresql"]' \ registry.redhat.io/rhel8/postgresql-10:1-203.1669834630 < postgres.tar
      Getting image source signatures
      Copying blob 7d40347a6323 skipped: already exists 
      Copying config 9677c61180 done 
      Writing manifest to image destination
      Storing signatures
      sha256:9677c61180520d0fa21306e20c0eb06cbd19f402ac5bdd618e81050da0f55dd6
      INFO[2023-04-21 13:58:35] Loading Quay image archive from quay.tar 
      DEBU[2023-04-21 13:58:35] Importing Quay with command: /bin/bash -c /usr/bin/podman image import \
      --change 'ENV PATH=/.local/bin/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' \
      --change 'ENV RED_HAT_QUAY=true' \
      --change 'ENV PYTHON_VERSION=3.8' \
      --change 'ENV PYTHON_ROOT=/usr/local/lib/python3.8' \
      --change 'ENV PYTHONUNBUFFERED=1' \
      --change 'ENV PYTHONIOENCODING=UTF-8' \
      --change 'ENV LANG=en_US.utf8' \
      --change 'ENV QUAYDIR=/quay-registry' \
      --change 'ENV QUAYCONF=/quay-registry/conf' \
      --change 'ENV QUAYRUN=/quay-registry/conf' \
      --change 'ENV QUAYPATH=.' \
      --change 'ENV QUAY_VERSION=v3.8.5' \
      --change 'ENV container=oci' \
      --change 'ENTRYPOINT=["dumb-init","--","/quay-registry/quay-entrypoint.sh"]' \
      --change 'WORKDIR=/quay-registry' \
      --change 'EXPOSE=7443' \
      --change 'EXPOSE=8080' \
      --change 'EXPOSE=8443' \
      --change 'VOLUME=/conf/stack' \
      --change 'VOLUME=/datastorage' \
      --change 'VOLUME=/tmp' \
      --change 'VOLUME=/var/log' \
      --change 'USER=1001' \
      --change 'CMD ["registry"]' \ registry.redhat.io/quay/quay-rhel8:v3.8.5 < quay.tar
      Getting image source signatures
      Copying blob 2396a86a7689 skipped: already exists 
      Copying config d161002440 done 
      Writing manifest to image destination
      Storing signatures
      sha256:d1610024407fe0f8b1dae58f4e6d06e47381225b00463551efea38285e030e11
      INFO[2023-04-21 13:58:49] Attempting to set SELinux rules on image archive 
      INFO[2023-04-21 13:58:49] Running install playbook. This may take some time. To see playbook output run the installer with -v (verbose) flag. 
      INFO[2023-04-21 13:58:49] Detected an installation to localhost 
      DEBU[2023-04-21 13:58:49] Running command: podman run --rm --interactive --tty --workdir /runner/project --net host -v /root/mirror-registry/image-archive.tar:/runner/image-archive.tar -v /root/.ssh/quay_installer:/runner/env/ssh_key -e RUNNER_OMIT_EVENTS=False -e RUNNER_ONLY_FAILED_EVENTS=False -e ANSIBLE_HOST_KEY_CHECKING=False -e ANSIBLE_CONFIG=/runner/project/ansible.cfg -e ANSIBLE_NOCOLOR=false --quiet --name ansible_runner_instance quay.io/quay/mirror-registry-ee:latest ansible-playbook -i root@ip-192-168-0-251.eu-west-1.compute.internal, --private-key /runner/env/ssh_key -e "init_user=init init_password=8c5wldpnH64eOIg0hZPbV1r9aDK2J3f7 quay_image=registry.redhat.io/quay/quay-rhel8:v3.8.5 quay_version=v3.8.5 redis_image=registry.redhat.io/rhel8/redis-6:1-92.1669834635 postgres_image=registry.redhat.io/rhel8/postgresql-10:1-203.1669834630 pause_image=registry.access.redhat.com/ubi8/pause:8.7-6 quay_hostname=ip-192-168-0-251.eu-west-1.compute.internal:8443 local_install=true quay_root=~/quay-install quay_storage=quay-storage pg_storage=pg-storage" install_mirror_appliance.yml -vvv 
      ERRO[2023-04-21 13:58:49] An error occurred: exit status 127 
      •  

      Tested in this configuration:

      [root@ip-192-168-0-251 mirror-registry]# sestatus 
      SELinux status:                 enabled
      SELinuxfs mount:                /sys/fs/selinux
      SELinux root directory:         /etc/selinux
      Loaded policy name:             targeted
      Current mode:                   enforcing
      Mode from config file:          enforcing
      Policy MLS status:              enabled
      Policy deny_unknown status:     allowed
      Memory protection checking:     actual (secure)
      Max kernel policy version:      33
      
      [ec2-user@ip-192-168-0-251 mirror-registry]$ df -h
      Filesystem      Size  Used Avail Use% Mounted on
      devtmpfs        3.8G     0  3.8G   0% /dev
      tmpfs           3.8G  168K  3.8G   1% /dev/shm
      tmpfs           1.6G   17M  1.5G   2% /run
      /dev/xvda4      600G   12G  588G   3% /
      /dev/xvda3      495M  136M  359M  28% /boot
      /dev/xvda2      200M  8.0K  200M   1% /boot/efi
      tmpfs           769M   16K  769M   1% /run/user/1000
      [ec2-user@ip-192-168-0-251 mirror-registry]$ lscpu
      Architecture:            x86_64
        CPU op-mode(s):        32-bit, 64-bit
        Address sizes:         46 bits physical, 48 bits virtual
        Byte Order:            Little Endian
      CPU(s):                  2
        On-line CPU(s) list:   0,1
      [ec2-user@ip-192-168-0-251 mirror-registry]$ lsmem
      RANGE                                  SIZE  STATE REMOVABLE BLOCK
      0x0000000000000000-0x00000000efffffff  3.8G online       yes  0-29
      0x0000000100000000-0x000000020fffffff  4.3G online       yes 32-65
      
      Memory block size:       128M
      Total online memory:       8G
      Total offline memory:      0B 
      [ec2-user@ip-192-168-0-251 mirror-registry]$ cat /etc/redhat-release 
      Red Hat Enterprise Linux release 9.0 (Plow) 
      [ec2-user@ip-192-168-0-251 mirror-registry]$ podman -v podman version 4.2.0
      

       

      Changing SELinux to permissive allows the installation to run correctly.

       

            Unassigned Unassigned
            laurent.tourreau Laurent TOURREAU
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: