Skip to content

Instantly share code, notes, and snippets.

@miminar

miminar/README.md

Last active May 22, 2020 06:38
Show Gist options
  • Save miminar/f9bd5c00be946026bd178ff1f816d6e2 to your computer and use it in GitHub Desktop.
Save miminar/f9bd5c00be946026bd178ff1f816d6e2 to your computer and use it in GitHub Desktop.
Download ZIP
Wrong HOME directory in /etc/passwd on OCP 4.2
Raw
README.md

Wrong HOME directory in /etc/passwd on OCP 4.2

Update on 22.5.2020: cannot reproduce anymore on vSphere with OCP 4.2 of version:

oc version
Client Version: openshift-clients-4.2.24-202003130432
Server Version: 4.2.33
Kubernetes Version: v1.14.6-152-g117ba1f

Cri-o on OCP 4.2 does not respect HOME environment directory set on image. It creates /etc/passwd in a container with / as HOME directory for the running user.

Reproduce:

oc new-project homedirissue
oc adm policy add-scc-to-user anyuid -z default
oc new-app -f https://gist.githubusercontent.com/miminar/f9bd5c00be946026bd178ff1f816d6e2/raw/8eb7ed5c65382ec9eaf251977486b6da21a372d8/homedirtmpl.yaml
oc rollout status -w dc/homedirissue

Check out the output of:

oc rsh dc/homedirissue /bin/sh -c 'set -x; whoami; id; eval '"'"'echo "$HOME"'"'"'; pwd; grep '^1000:' /etc/passwd'

As of

oc version
Client Version: openshift-clients-4.2.2-201910250432
Server Version: 4.2.21
Kubernetes Version: v1.14.6+06eeef5

the output is:

oc rsh dc/homedirissue /bin/sh -c 'set -x; whoami; id; eval '"'"'echo "$HOME"'"'"'; pwd; grep '^1000:' /etc/passwd'
+ whoami
1000
+ id
uid=1000(1000) gid=0(root) groups=0(root)
+ eval echo "$HOME"
+ echo /home/1000
/home/1000
+ pwd
/home/1000/homedirissue-img
+ grep ^1000: /etc/passwd
1000:x:1000:0:1000 user:/:/sbin/nologin

The expected last line is:

1000:x:1000:0:1000 user:/home/1000:/sbin/nologin

Results on OCP 3.11

OCP Version:

oc version
oc v3.11.187
kubernetes v1.11.0+d4cacc0
features: Basic-Auth GSSAPI Kerberos SPNEGO

Server https://lu0531v0.wdf.sap.corp:8443
openshift v3.11.153
kubernetes v1.11.0+d4cacc0

Docker version:

ansible -m shell -i hosts nodes -b -a 'docker version'
lu0531v2.wdf.sap.corp | CHANGED | rc=0 >>
Client:
 Version:         1.13.1
 API version:     1.26
 Package version: docker-1.13.1-103.git7f2769b.el7.x86_64
 Go version:      go1.10.8
 Git commit:      7f2769b/1.13.1
 Built:           Fri Aug  2 10:19:53 2019
 OS/Arch:         linux/amd64

Server:
 Version:         1.13.1
 API version:     1.26 (minimum version 1.12)
 Package version: docker-1.13.1-103.git7f2769b.el7.x86_64
 Go version:      go1.10.8
 Git commit:      7f2769b/1.13.1
 Built:           Fri Aug  2 10:19:53 2019
 OS/Arch:         linux/amd64
 Experimental:    false
...

Output of the debug command:

oc rsh dc/homedirissue /bin/sh -c 'set -x; whoami; id; eval '"'"'echo "$HOME"'"'"'; pwd; grep '^1000:' /etc/passwd'
+ whoami
whoami: cannot find name for user ID 1000
+ id
uid=1000 gid=0(root) groups=0(root)
+ eval echo "$HOME"
+ echo /home/1000
/home/1000
+ pwd
/home/1000/homedirissue-img
+ grep ^1000: /etc/passwd
command terminated with exit code 1
Raw
homedirtmpl.yaml
kind: Template
apiVersion: v1
metadata:
name: homedirissue
objects:
-
apiVersion: v1
kind: ImageStream
metadata:
name: fedora
spec:
tags:
- from:
kind: DockerImage
name: quay.io/fedora/fedora:31-x86_64
name: latest
-
apiVersion: v1
kind: ImageStream
metadata:
name: homedirissue
spec:
status:
dockerImageRepository: ""
-
kind: BuildConfig
apiVersion: build.openshift.io/v1
metadata:
name: "homedirissue"
spec:
runPolicy: "Serial"
triggers:
-
type: "ImageChange"
source:
dockerfile: |
FROM fedora:latest
RUN whoami; id; echo "$HOME"
RUN printf "/usr/bin/env bash\nsleep infinity" >/entrypoint.sh && chmod +x /entrypoint.sh
ENTRYPOINT /entrypoint.sh
USER 0
ENV HOME=/home/1000
RUN mkdir -p "${HOME}" && chown -R "1000:1000" "${HOME}"
USER 1000
WORKDIR ${HOME}/homedirissue-img
strategy:
dockerStrategy:
from:
kind: "ImageStreamTag"
name: "fedora:latest"
output:
to:
kind: "ImageStreamTag"
name: "homedirissue:latest"
-
kind: Service
apiVersion: v1
metadata:
name: homedirissue
spec:
ports:
-
name: web
protocol: TCP
port: 5432
targetPort: 8080
nodePort: 0
selector:
name: homedirissue
type: ClusterIP
sessionAffinity: None
status:
loadBalancer: {}
-
kind: Route
apiVersion: v1
metadata:
name: homedirissue-route-edge
annotations:
template.openshift.io/expose-uri: 'http://{.spec.host}{.spec.path}'
spec:
to:
kind: Service
name: homedirissue
tls:
termination: edge
status: {}
-
kind: DeploymentConfig
apiVersion: v1
metadata:
name: homedirissue
annotations:
template.alpha.openshift.io/wait-for-ready: 'true'
spec:
strategy:
type: Rolling
rollingParams:
updatePeriodSeconds: 1
intervalSeconds: 1
timeoutSeconds: 120
resources: {}
triggers:
-
type: ImageChange
imageChangeParams:
automatic: true
containerNames:
- homedirissue
from:
kind: ImageStreamTag
name: 'homedirissue:latest'
-
type: ConfigChange
replicas: 1
selector:
name: homedirissue
template:
metadata:
labels:
name: homedirissue
spec:
containers:
-
name: homedirissue
image: homedirissue:latest
env:
resources: {}
imagePullPolicy: Always
securityContext:
runAsUser: 1000
capabilities: {}
privileged: false
restartPolicy: Always
dnsPolicy: ClusterFirst
status: {}
labels:
template: application-template-dockerbuild
Raw
ocp311-debug-cmd.log
oc rsh dc/homedirissue /bin/sh -c 'set -x; whoami; id; eval '"'"'echo "$HOME"'"'"'; pwd; grep '^1000:' /etc/passwd'
+ whoami
whoami: cannot find name for user ID 1000
+ id
uid=1000 gid=0(root) groups=0(root)
+ eval echo "$HOME"
+ echo /home/1000
/home/1000
+ pwd
/home/1000/homedirissue-img
+ grep ^1000: /etc/passwd
command terminated with exit code 1
Raw
ocp311-image-description.log
oc describe image "$(oc get is/homedirissue -o jsonpath='{.status.tags[0].items[0].image}')"
Docker Image: docker-registry.default.svc:5000/homedirissue/homedirissue@sha256:e90566fc5b806da81f00e66b7e27e24ccf7b6a9f652bdf62fdf61bb8de6ca825
Name: sha256:e90566fc5b806da81f00e66b7e27e24ccf7b6a9f652bdf62fdf61bb8de6ca825
Created: 7 minutes ago
Annotations: image.openshift.io/dockerLayersOrder=ascending
image.openshift.io/manifestBlobStored=true
openshift.io/image.managed=true
Image Size: 260.9MB in 13 layers
Layers: 52.48MB sha256:1ade878aecd1a340488a3c0a9b925dfa454339c32ebf816219b49012928c7f06
19.18MB sha256:fdca7d84dcafb8eff1bdd575932747d8a402f28d0c900f3a707102b9310d556b
43.16MB sha256:552f29470ea9fa201a7908f6d3ed9b69e8456cd0887d135748dfd42be629a493
131.7MB sha256:aadbe7e3b2a5dbdee214918f9ae1867cb6e22e974f642cc4133a7ef51ed7a3b2
4.387kB sha256:5560c893244a1595f48880ae1c08b35e36e89852f5f86db38132154c8d1366a5
97.27kB sha256:b901fe3f98affea2b14d435d7f26190c8393b0dcd6d9403b905102192d0a2345
14.29MB sha256:4f0f3135527abad581c83441fa469cc7d129132d2aa5c5e0521976a62c4fd492
276B sha256:c13bfe0e6d88b0844b37cc2c6d1c2f591b8ddb8ea7cd67f4f89833c23c6413a7
149B sha256:8914fab1e67b03a9099d2daa94fd832aed462e6936edbfbe6aeb2643720e8dd5
1.568kB sha256:c90d37acd15bf137851122f3141af7d44f4767f6646902606d7de2e16bf1cb32
146B sha256:b053b745974ecd0b325f8a642553dee9ed3f1099281fbd7de9896a35859153cb
152B sha256:1574641c1b0aa8f50b4b6c7f25ebc695a2435d10599ecbe1834533649a0d9efa
180B sha256:9feb8c312238476b4c8d5c6d7fbbbbc4cc656a5a98559770b394551d27b94f1e
Image Created: 7 minutes ago
Author: <none>
Arch: amd64
Entrypoint: /bin/sh -c /entrypoint.sh
Working Dir: /home/1000/homedirissue-img
User: 1000
Exposes Ports: 8080/tcp
Docker Labels: io.openshift.build.name=homedirissue-build-1
io.openshift.build.namespace=homedirissue
Environment: PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
NPM_CONFIG_LOGLEVEL=info
NODE_VERSION=6.9.2
HTTP_PROXY=http://proxy.wdf.sap.corp:8080
HTTPS_PROXY=http://proxy.wdf.sap.corp:8080
NO_PROXY=.cluster.local,.localdomain,.nip.io,.sap.corp,.svc,.wdf,10.16.58.91,10.16.69.115,10.16.84.0,10.76.34.28,169.254.169.254,172.30.0.1,localhost,lu0531v0.wdf.sap.corp
http_proxy=http://proxy.wdf.sap.corp:8080
https_proxy=http://proxy.wdf.sap.corp:8080
no_proxy=.cluster.local,.localdomain,.nip.io,.sap.corp,.svc,.wdf,10.16.58.91,10.16.69.115,10.16.84.0,10.76.34.28,169.254.169.254,172.30.0.1,localhost,lu0531v0.wdf.sap.corp
HOME=/home/1000
OPENSHIFT_BUILD_NAME=homedirissue-build-1
OPENSHIFT_BUILD_NAMESPACE=homedirissue
Raw
ocp42-debug-cmd.log
oc rsh dc/homedirissue /bin/sh -c 'set -x; whoami; id; eval '"'"'echo "$HOME"'"'"'; pwd; grep '^1000:' /etc/passwd'
+ whoami
1000
+ id
uid=1000(1000) gid=0(root) groups=0(root)
+ eval echo "$HOME"
+ echo /home/1000
/home/1000
+ pwd
/home/1000/cwdtest-img
+ grep ^1000: /etc/passwd
1000:x:1000:0:1000 user:/:/sbin/nologin
Raw
ocp42-image-description.log
oc describe image "$(oc get is/homedirissue -o jsonpath='{.status.tags[0].items[0].image}')"
Docker Image: image-registry.openshift-image-registry.svc:5000/homedirissue/homedirissue@sha256:d97c5a6325f0f75d8056b8747e11bb64d7124d13eb9a5ac62cd40295df93b10d
Name: sha256:d97c5a6325f0f75d8056b8747e11bb64d7124d13eb9a5ac62cd40295df93b10d
Created: 2 minutes ago
Annotations: image.openshift.io/dockerLayersOrder=ascending
image.openshift.io/manifestBlobStored=true
openshift.io/image.managed=true
Image Size: 260.9MB in 12 layers
Layers: 52.48MB sha256:1ade878aecd1a340488a3c0a9b925dfa454339c32ebf816219b49012928c7f06
19.18MB sha256:fdca7d84dcafb8eff1bdd575932747d8a402f28d0c900f3a707102b9310d556b
43.16MB sha256:552f29470ea9fa201a7908f6d3ed9b69e8456cd0887d135748dfd42be629a493
131.7MB sha256:aadbe7e3b2a5dbdee214918f9ae1867cb6e22e974f642cc4133a7ef51ed7a3b2
4.387kB sha256:5560c893244a1595f48880ae1c08b35e36e89852f5f86db38132154c8d1366a5
97.27kB sha256:b901fe3f98affea2b14d435d7f26190c8393b0dcd6d9403b905102192d0a2345
14.29MB sha256:4f0f3135527abad581c83441fa469cc7d129132d2aa5c5e0521976a62c4fd492
276B sha256:c13bfe0e6d88b0844b37cc2c6d1c2f591b8ddb8ea7cd67f4f89833c23c6413a7
146B sha256:3873112a06ef51ef0ced46bacc53718b4cb1635762ac36a4073b963dea0eb4d9
1.748kB sha256:3be72d5d2d064dfa1e6f5b8e53932d6b49f851ed13104ba2381f128c629ffad9
168B sha256:05e310d1493a7a8490491c37145d257f95bdd8bdd8cf9f32e5b0a47ef59ceac3
150B sha256:2b42b375959bb65e646c37149a174ee17d9ca77b60b2816e1607dd44a41decad
Image Created: 2 minutes ago
Author: <none>
Arch: amd64
Entrypoint: /bin/sh -c /entrypoint.sh
Working Dir: /home/1000/homedirissue-img
User: 1000
Exposes Ports: 8080/tcp
Docker Labels: io.openshift.build.name=homedirissue-build-1
io.openshift.build.namespace=homedirissue
Environment: PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
NPM_CONFIG_LOGLEVEL=info
NODE_VERSION=6.9.2
HOME=/home/1000
OPENSHIFT_BUILD_NAME=homedirissue-build-1
OPENSHIFT_BUILD_NAMESPACE=homedirissue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment