genuinetools / img

Standalone, daemon-less, unprivileged Dockerfile and OCI compatible container image builder.
https://blog.jessfraz.com/post/building-container-images-securely-on-kubernetes/
MIT License
3.88k stars 230 forks source link

Support for Debian stretch platform #271

Open jeunii opened 4 years ago

jeunii commented 4 years ago

I would like to integrate img functionality into my already exiting container thats based off of debain stretch. But im running into a few issues. Right now in my already exiting Dockerfile, I am getting the binary and moving it to my PATH

FROM debian:stretch
.
.
.
# img
ARG IMG_VERSION=v0.5.7
RUN curl -fSL https://github.com/genuinetools/img/releases/download/${IMG_VERSION}/img-linux-amd64 -o /usr/local/bin/img && \
    chmod a+x /usr/local/bin/img

Now if I run the above as root user, I can successfully run a img pull

$ docker run -it --privileged 30c92ae6f3b5 bash
root@491b20129d4f:/# img pull debian:testing-slim
Pulling debian:testing-slim...
Pulled: sha256:0a8e71d161b3b2a57da70cd62246c57275404307c42bbd22c5df9ac9ee97d445
Size: 26.46MiB

But part of my flow is that I need to switch to another user.

.
.
RUN chmod +x /usr/local/bin/jenkins-slave && \
    groupadd -g ${GID} ${GROUP} && \
    useradd -c "Jenkins user" -d ${JENKINS_HOME} -u ${UID} -g ${GID} -m ${USER}
.
.
USER ${USER}

Now when I spun up my base docker image, I get

$ docker run -it --privileged slave:1.0.7 bash

jenkins@0291b17a4f72:~$ img pull debian:testing-slim
newuidmap: write to uid_map failed: Invalid argument
nsenter: failed to use newuidmap: No such file or directory
nsenter: failed to sync with parent: SYNC_USERMAP_ACK: got 255: No such file or directory

What do all of these errors mean ? And is there something I can do about it ?

issue-label-bot[bot] commented 4 years ago

Issue Label Bot is not confident enough to auto-label this issue. See dashboard for more details.

oxr463 commented 4 years ago

Possible duplicate of https://github.com/genuinetools/img/issues/191