search

coder / envbuilder

Build development environments from a Dockerfile on Docker, Kubernetes, and OpenShift. Enable developers to modify their development environment quickly.
Apache License 2.0
142 stars 26 forks source link

fix(remount): ensure mountpoint is a file for files #249

Closed maxbrunet closed 3 months ago

maxbrunet commented 3 months ago

Fixes errors like:

error: temp remount: temp remount: bind mount /usr/bin/nvidia-smi => /.envbuilder/mnt/usr/bin/nvidia-smi: not a directory

Follow up to #183

maxbrunet commented 3 months ago

Apparently that's not enough, maybe files need extra flags or something, I'll try to investigate:

error: temp remount: temp remount: bind mount /usr/bin/nvidia-smi => /.envbuilder/mnt/usr/bin/nvidia-smi: no such file or directory
johnstcn commented 3 months ago

Apparently that's not enough, maybe files need extra flags or something, I'll try to investigate:

error: temp remount: temp remount: bind mount /usr/bin/nvidia-smi => /.envbuilder/mnt/usr/bin/nvidia-smi: no such file or directory

What are you trying to accomplish exactly? Can you provide steps to reproduce?

maxbrunet commented 3 months ago

Fixed. The file mountpoint must exist

The main use case would probably usage of pod.spec.containers.volumeMounts.subPath where the subPath is a file and readOnly is also set.

But I'm experimenting with GPUs, the NVIDIA container runtime mounts a lot of things. Now I'm back to the known issue with Kaniko

pod.yaml ```yaml apiVersion: v1 kind: Pod metadata: name: envbuilder spec: containers: - name: envbuilder image: ghcr.io/coder/envbuilder-preview env: - name: FALLBACK_IMAGE value: busybox - name: INIT_SCRIPT value: sh resources: limits: nvidia.com/gpu: "1" securityContext: privileged: true ```

These paths need privileges to be remounted, I am thinking ignorePrefixes should be an extension of ignorePaths since there are ignored, it should not be needed to remount them. I can try that in a separate PR

https://github.com/coder/envbuilder/blob/b06565690cd7a94a06b2da0858dbbf0542fd71f8/envbuilder.go#L436

Edit: I have a workaround for the Kaniko issue, I'll open a PR for that too

maxbrunet commented 3 months ago

Thank you @johnstcn, this looks good to me. There is more to consider for NVIDIA and I am not sure ignorePaths will solve everything, but I'll get into the specifics on the related issue, I don't want to sidetrack this PR too much :)

johnstcn commented 3 months ago

Thanks for the collaboration @maxbrunet!