temporalio / docker-builds

Temporal service Docker images build
https://hub.docker.com/r/temporaliotest/auto-setup
MIT License
30 stars 59 forks source link

[Feature Request] Support for OpenShift #241

Open hishamanver opened 2 months ago

hishamanver commented 2 months ago

Is your feature request related to a problem? Please describe.

I attempted to deploy temporal via helm (https://github.com/temporalio/helm-charts/tree/main) onto an openshift cluster.

Ran into issues running the temporal server and temporal ui containers on openshift due to security constraints (running on openshift - https://cloud.redhat.com/blog/a-guide-to-openshift-and-uids)

Identified the root cause to be the following sections:

Essentially what we are observing is openshift enforces specific UID and GID for the running containers that do not match the predefined values in the image definition and therefore fail with the following error:

TEMPORAL_ADDRESS is not set, setting it to 100.72.8.241:7233
2024/09/13 06:13:46 unable to create open /etc/temporal/config/docker.yaml: permission denied

Describe the solution you'd like

Dockerfile definition should not pin specific UIDs for non root user enforcement, but instead ensure that all directories that are required for functionality have sufficient privileges.

To get around this issue the following Dockerfile was used and confirmed to work

FROM temporalio/server:1.25.0

RUN chmod o+w /etc/temporal/config/
mohan-alpheya commented 2 months ago

The below article explains what needs to done to use single Dockerfile to create an image that functions correctly, both on OpenShift and on Kubernetes.

https://developers.redhat.com/blog/2020/10/26/adapting-docker-and-kubernetes-containers-to-run-on-red-hat-openshift-container-platform#group_ownership_and_file_permission

image

robholland commented 1 month ago

We will be removing the need for Temporal to write to the filesytem for our docker containers, which will avoid this issue.

robholland commented 1 month ago

Relevant PR: https://github.com/temporalio/temporal/pull/6251

mohan-alpheya commented 1 month ago

temporalio/ui also writes to the filesytem. the above PR fix ui image also?

robholland commented 1 month ago

That would need to be handled separately, I'll look at this once we've fixed it for Temporal server. https://github.com/temporalio/ui/issues/1703