search

quay / clair

Vulnerability Static Analysis for Containers
https://quay.github.io/clair/
Apache License 2.0
10.36k stars 1.16k forks source link

chore: allow podman to relabel files objects #2079

Closed crozzy closed 4 months ago

crozzy commented 4 months ago

Currently there is an issue when attempting to bind mount certain files during the container build process. This appears to be a combination of podman and SELinux conspiring to lead to the cryptic error: 

go: no modules specified (see 'go help mod download')

Which logically leads to something going wrong mounting the go.mod / go.sum files.

https://ci.ext.devshift.net/job/quay-clair-gh-build-main/460/console

crozzy commented 4 months ago

This problem appeared after switching the builder (back) to podman from docker

hdonnay commented 4 months ago

Does this work for docker? The z option isn't documented there.

I really hate this docker/podman incompatibility. Maybe we should only support using buildkit, so we can control the frontend that's used.

crozzy commented 4 months ago

No, doesn't work for docker it turns out, damn.

Looking at the buildkit docs (https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/reference.md#run---mounttypebind) I don't see an option for this either (which makes sense I suppose given they aren't supported by docker). Maybe it's worth removing those bind mounts and COPYing the go.{mod,sum}?

hdonnay commented 4 months ago

superseded by #2083