search

chainguard-dev / melange

build APKs from source code
Apache License 2.0
425 stars 106 forks source link

Usage without `privileged` flag #285

Open janbaudisch opened 1 year ago

janbaudisch commented 1 year ago

I really like the idea of this tool in combination with apko. However, I tried using it in a GitLab CI environment with only a Docker executor and without the ability use privileged containers. Therefore, when running the first pipeline step, bubblewrap will fail:

bwrap: Creating new namespace failed: Operation not permitted

I know that this is currently expected. I just wanted to ask whether there is any way to work around this or if there are plans to add an unprivileged mode to melange?

kaniini commented 1 year ago

Melange needs the ability to create a new container, either via bubblewrap or via Docker. If you arrange for the /var/lib/docker.sock to be present, it should be able to use that instead.

adam-moss commented 1 year ago

We use docker-in-docker in GitLab CI for this purpose.

jzeminski commented 10 months ago

Is a solution using kaniko possible? I'm running in a secure environment that doesn't seem to allow privileged runners and keep getting the above mentioned bubblewrap error.

dwalrond commented 3 months ago

Having the ability to run unprivileged means I can use this tool within my CI/CD pipeline. It also appears #1243 the option --runner kubernetes gives error ERRO unknown runner: kubernetes.

I cannot justify a custom runner to workaround this. Will have to look at alternative tools like kaniko and not use chainguard at this time.