skopeo copy failure on RedHat EL 8

[dergraf]

Hi, thanks for your work on nix2container. I've stumbled upon your work when experimenting with devenv.sh Copy the genereated image spec Json to the containers-storage using the bundled/patched skopeo doesn't work for me on RHEL. It fails with a rather unspecific error similar* to "can't determine user: unknown, userid:123456789". The same error is generated when using a 'standard' docker transport instead of nix.

However, with the stock skopeo copying to containers-storage works as expected.

Any pointers?

• This happened on my work machine, i don't have the exact error message right now.

[nlewo]

Could you get the patched Skopeo version, get the version from upstream and try with this version to push an image?

If it is because the patched Skopeo version is too old, we could then update it.

[dergraf]

Thanks for the quick answer. As mentioned, the patched skopeo doesn't work for me. Should I test with a different patch than what is used in the version used by current nix2container?

I'll try with the skopeo from nixpkgs tomorrow, I guess it will work and behave as the one preinstalled on my RHEL work machine.

[nlewo]

IIUC your first comment, you are not able to push a standard image (skopeo docker-archive://...) with the patched Skopeo. In this case, i don't think the issue is the patch, but more the version of the patched Skopeo which could be too old. (The patch only adds a new Skopeo transport and should not have any impact on other transports.)

So, to validate it is related to the version of Skopeo, I proposed to try to push a standard image with the standard Skopeo (the upstream one), but in the same version than the patched Skopeo.

Also, trying with the Skopeo from nixpkgs is a good idea. Maybe it is related to the way we are building or configuring it.

[dergraf]

Perfect, makes sense. Will do it and report back asap.

[dergraf]

This happens on a RHEL8 running in VMWare Tried command: skopeo --insecure-policy copy docker://foo containers-storage:foo

skopeo 1.11.2-dev (pre-installed via RPM skopeo-2:1.11.2-0.2.module+el8.8.0+18251+ad5b274c.x86_64): command works as expected skopeo 1.12.0 (installed via RPM skopeo-1.12.0-2.module_el8+460+8cac93c8): command works as expected skopeo 1.11.1 (installed via nixpkgk) command doesn't work: Error ERRO[0000] error determining current user: user: unknown userid 1234567890 skopeo 1.12.0 (installed via nixpkgs) command doesn't work: Error ERRO[0000] error determining current user: user: unknown userid 1234567890 skopeo 1.12.0 (patched installed via nix2container) command doesn't work: Error ERRO[0000] error determining current user: user: unknown userid 1234567890

I guess this issue is RHEL specific and has nothing to do with nix2container, possibly related to SELinux.

[dergraf]

Update: running the patched skopeo with sudo builds the expected image.

[dergraf]

It looks like a sytem update coupled with some nix updates resolved the issue