Open deliciouslytyped opened 10 months ago
podman-compose appears to implement some flag passing in https://github.com/containers/podman-compose/issues/278 but on a very superficial look it sounds a bit janky.
There is some consideration for extending the compose specification:
Docker appears to have something against the idea of lifecycle hooks because it's bad for portability (and security? - I'm somewhat skeptical this isn't a moot point.) or something. compose-spec seems to be a repo managed by docker, which is not a good sign for having lifecycle management in the spec.
There is also another idea of init containers (which may be extendable to lifecycle managing containers? - I haven't read the page yet):
It may or may not be a problem that https://github.com/opencontainers/runtime-spec/blob/v1.0.1/config.md#posix-platform-hooks requires paths to be absolute. (Why?)
I'm interested in executing code on container bringup and takedown (for example to snapshot volumes). I've taken some notes below on what I found on OCI hooks, and the question is whether there is a good way this could be handled by Arion.
I happen to be using podman, which seems to support OCI hooks, which appears to be the correct way to do something like this.
It may actually be more appropriate to ask whether podman-compose should be handling this with possibly custom compose attributes, and until it does, how it could be done with Arion.
My initial idea is that as long as --hooks-dir can be passed through to podman, maybe this should work.
@roberth do you have any thoughts?
Notes: OCI hooks seem to be specified in https://github.com/opencontainers/runtime-spec/blob/main/config.md#user-content-posix-platform-hooks , and the podman option seems to be explained in https://docs.podman.io/en/latest/markdown/podman.1.html#hooks-dir-path :
oci-hooks(5) appears to be a documentation file in the podman common repo: https://github.com/containers/common/blob/main/pkg/hooks/README.md https://github.com/containers/common/blob/main/pkg/hooks/docs/oci-hooks.5.md
EDIT: Note: the oci-hooks(5) config seems to differ from the hook format given in runtime-spec.
The library implementing the hooks for podman appears to be documented at https://pkg.go.dev/github.com/containers/podman/v3/pkg/hooks#section-readme
Not all runtimes appear to support hooks, for example crio does and containerd will (but does not yet):
Given these, I'm not actually sure if it's the runtime behind podman supporting the hooks in podmans case, or podman itself. Going by the podman documentation, I get the impression that it's podman. But then does that mean hooks are possibly handled twice, both by podman and the runtime?
Here are some example hooks from a completely unrelated system: https://sarus.readthedocs.io/en/stable/config/configure_hooks.html
There are possibly other solutions such as dealing with systemd or filtering podman events, ( https://www.reddit.com/r/podman/comments/v6adqi/is_there_any_way_to_subscribe_to_podman_events/ ) but hooks appear to be the most correct solution. (or for example
The alternative for runc hook users is to proxy or replace runc with their own version of runc, which is not a good solution.
mentioned in the containerd issue.)This may or may not be related to https://github.com/hercules-ci/arion/issues/48 . I'm not sure if the discussion there implies that this won't work with docker without something like https://github.com/awslabs/oci-add-hooks .
Some other misc links: