Skip to content

Instantly share code, notes, and snippets.

@vorburger
Created December 6, 2018 22:02
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save vorburger/ea367a76f69aafb8260c62f6bedf2788 to your computer and use it in GitHub Desktop.
Save vorburger/ea367a76f69aafb8260c62f6bedf2788 to your computer and use it in GitHub Desktop.
https://github.com/fabric8io-images/s2i/issues/206
https://github.com/fabric8io-images/s2i/issues/172
(09:59:45 CET) vorburger: hello people of CentOS. I'm observing a VERY strange thing possibly related to the CentOS 7.6 container image release earlier today, full story is https://github.com/fabric8io-images/s2i/issues/206, the gist of it is:
(10:01:20 CET) vorburger: it looks to me like old stable 7.5.1804 on https://hub.docker.com/r/library/centos/tags/ got replaced with 7.6.1810 a few hours ago today, despite 7.5.1804 saying (on the UI) it hasn't changed in 2 months
(10:02:06 CET) billings: vorburger: Step 7/37 : RUN yum install -y unzip java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5
(10:02:27 CET) billings: why is it installing a specific version of openjdk? That's why it doesn't work. That version isn't in 7.6.
(10:03:03 CET) billings: https://github.com/fabric8io-images/s2i/blob/master/java/images/centos/Dockerfile this needs to be fixed, hopefully by someone who understands how to use CentOS
(10:04:03 CET) vorburger: billings: Sketch: thanks for engaging! May be I'm misinterpreting this - it's not the container image itself but the RPM registry where it pulls packages from..
(10:04:14 CET) Sketch: for a in $(yum list installed|awk '{print $1}'); do yum reinstall $a ; done
(10:04:25 CET) billings: vorburger: its asking for a version of a package that doesn't exist anymore in the standard CentOS repos
(10:04:37 CET) TrevorH: no, that's doing a yum install for a specific java package with full version number
(10:05:04 CET) vorburger: Sketch: oh sorry I got confused because I just joined the channel, I'll just chat with billings then ;-)
(10:05:09 CET) TrevorH: java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5 not just java-1.8.0-openjdk
(10:05:43 CET) billings: if you adjust the Dockerfile to just refer to 'java-1.8.0-openjdk' instead of java-1.8.0-openjdk-1.8.0.181-3.b13.el7_5, I bet it'd work fine
(10:05:54 CET) TrevorH: current version is 1:1.8.0.191.b12-1.el7_6
(10:06:11 CET) billings: it pains me to see specific versions like that, but *shrug*
(10:06:16 CET) vorburger: billings: TrevorH: forget about 7.6; I understand that 1.8.0.181-3.b13.el7_5 is not in 7.6, I'm concerned about the opposite here, is it normal that 1.8.0.181-3.b13.el7_5 disappeared from 7.5 (not 7.6) when it still worked a week ago?
(10:06:44 CET) billings: vorburger: you might be a bit confused -- there is no 7.5 or 7.6. There's just the latest version of CentOS 7
(10:07:00 CET) TrevorH: 7.5 is gone
(10:07:06 CET) billings: the numbers after it are really just indicators of the latest major release, but they are not tracked separately in the repos
(10:07:22 CET) TrevorH: if you don't want to hit this sort of error then don't install explicit version numbers
(10:07:34 CET) billings: if you install CentOS 7.5, and run 'yum update' it is now 7.6.
(10:07:47 CET) vorburger: billings: TrevorH: wait a second - if I, or anyone else, have an existing Dockerfile "FROM centos:7.5.1804" that is meaningless?
(10:07:56 CET) vorburger: billings: oh because it does 'yum update' ... ah.
(10:08:03 CET) ***Sketch awaits the inevitable "but we want to install insecure versions of java" argument
(10:08:12 CET) billings: that might be a tag for a package that was built in the past, and most likely has really out of date packages
(10:08:21 CET) billings: er, a tag for a container ...
(10:08:41 CET) billings: but if you do anything like 'yum update' or 'yum install' it will be pulling down stuff packaged for the latest release.
(10:08:44 CET) vorburger: billings: but https://github.com/fabric8io-images/s2i/blob/master/java/images/centos/Dockerfile does not do "yum update" anywhere
(10:08:53 CET) billings: yes, but it does a yum install
(10:08:57 CET) vorburger: billings: oh
(10:09:05 CET) billings: yum install pulls from the only supported release channel
(10:09:23 CET) TrevorH: the repos now contain 7.6 not 7.5. Some 7.6 packages _may_ be the same versions as those from 7.5 but something like 3500 of them got updated and got new version numbers
(10:09:50 CET) TrevorH: if you now try to install that 7.5 version number when 7.6 contains a newer one, it will fail
(10:09:51 CET) billings: and more importantly, none of the CentOS repos contain that old version of java
(10:10:05 CET) ***Sketch checks the repos and notes that java-1.8.0-openjdk-1.8.0.191.b12-1.el7_6.x86_64.rpm is in el7.6's updates, but not in el7.5's
(10:10:21 CET) TrevorH: whereas if you just `yum install java-1.8.0-openjdk` it will pull the latest version
(10:10:30 CET) Sketch: so you probably only got it as an update for el7 after 7.6 was released (or from cr, if that was enabled)
(10:10:34 CET) vorburger: Sketch: I'm gong going to say that I want to install insecure versions of java ... ;-) someone expressed on https://github.com/fabric8io-images/s2i/issues/172 that other maintainers of that project wanted 7.5.1804
(10:10:36 CET) Zathrus: the short version is, please stop specifying minor version numbers. Build off centos:7, not centos:7.5
(10:10:48 CET) ***billings nods
(10:10:53 CET) TrevorH: 7.5.1804 is deprecated and no longer current
(10:11:03 CET) coldice: vorburger: should then create your own repo and host it :-)
(10:11:10 CET) vorburger: ok I'll ditch the minor version number of the Java package, got it
(10:11:39 CET) Zathrus: if you're going to insist on a minor release number, you need RHEL and EUS.
(10:11:41 CET) vorburger: would any of you experts be willing to chime in and comment onhttps://github.com/fabric8io-images/s2i/issues/172 ? So I actually suggested that we just use centos:7
(10:12:13 CET) vorburger: there is a RHEL image in that same project as well, this is about the CentOS image suddenly breaking today and me trying to fix it. And what is EUS now?
(10:12:19 CET) billings: rhuss's hope to make it reproducable is not reflecting reality
(10:12:32 CET) Sketch: RHEL actually does maintain support for older releases (to a point)
(10:12:42 CET) TrevorH: RHEL is different. Its repos contain all versions of all packages since 7.0 was released
(10:12:48 CET) billings: I don't know if you can build docker images against RHEL's EUS channels except when using a private container registry run by redhat
(10:12:58 CET) vorburger: billings: OK if you could chime on that issue and correct my friend rhuss then I'll change that right now and self merge it in 1 minute
(10:13:42 CET) Zathrus: billings: certainly not a public one
(10:13:54 CET) billings: iirc I'm running containers in openshift that are based on rhel
(10:14:05 CET) billings: I don't look to closely because I don't really want to see how the sausage is made
(10:15:29 CET) vorburger: wait, I'm still not crystal clear if the right thing to do here is to only ditch the minor version number of the yum install openjdk or do that but also change the Dockerfile's FROM to centos:7.5.1804 or just centos:7 - opinions? a) just yum package; b) both
(10:17:08 CET) TrevorH: no idea what the 7.5.1804 is used for
(10:19:12 CET) billings: Commenting
(10:19:25 CET) billings: Both
(10:19:38 CET) billings: I didn't comment about the broken OpenJDK, because that's a separate issue
(10:20:47 CET) billings: it looks like TrevorH already commented on #206 so I'll leave it there
(10:21:54 CET) vorburger: sure, I'm changing both, in two separate commits; removing the minor version of the OpenJDK package fixes https://github.com/fabric8io-images/s2i/issues/206 and using just 7 instead of 7.5.1804 for https://github.com/fabric8io-images/s2i/issues/172 .. thanks to all of you!
(10:22:33 CET) Evolution: vorburger: for the record, I *own* the base containers you're pulling from for centos:7 etc.
(10:23:01 CET) billings: yeah, Evolution is the maintainer of the centos registry
(10:23:02 CET) Evolution: the minor release tags are to correspond directly to the install media. They aren't updated
(10:23:16 CET) Evolution: not the registry, just the base containers for dockerhub
(10:23:18 CET) Evolution: but yeah
(10:23:30 CET) billings: er, I mean the centos: entries in dockerhub
(10:23:38 CET) vorburger: Evolution: Cool. If you want to chime in on s https://github.com/fabric8io-images/s2i/issues/206 a that using 1.8.0.181-3.b13.el7_5 is wrong and on https://github.com/fabric8io-images/s2i/issues/172 that 7.5.1804 is wrong that will make it official! ;=)
(10:23:44 CET) billings: do you maintain them in any of the other registries? (since I'm a buildah user now)
(10:23:48 CET) Evolution: vorburger: the major tags centos:7 for example is the rolling release, and the dockerhub guys *just* merged the update to 7.6 this morning
(10:24:00 CET) Evolution: billings: no.
(10:24:24 CET) Evolution: vorburger: so if you did a fresh docker pull this morning, you'd have gotten 7.6.1810
(10:24:51 CET) vorburger: Evolution: billings: actually what is the pointing of having a 7.5.1804 tag on Docker Hub then? That seems to create more confusion (to me at least) than anything else..
(10:25:19 CET) vorburger: Evolution: uhu, I noticed, and have been banging my head against my desk in https://github.com/fabric8io-images/s2i/issues/206 for a few hours ;-)
(10:25:33 CET) Sketch: i suppose if you your own self-hosted centos 7.5.1804 repos, it would make sense
(10:25:35 CET) Evolution: vorburger: so, I *hate* the minor tags. I wanted to not do them.
(10:25:57 CET) Evolution: vorburger: community pushed HARD to have them because lots of shops have to pin to a specific version for compliance reasons.
(10:26:21 CET) billings: dispite the fact that they don't actually do what they think?
(10:27:04 CET) Evolution: billings: yup.
(10:27:09 CET) billings: too bad.
(10:27:15 CET) Evolution: and the repos all point to /7/ anyway so they update nearly immediately.
(10:27:22 CET) coldice: Sketch: installing all the packages again fixed the issue. Hopefully everything runs smoothly. And thanks Trevor
(10:27:23 CET) billings: next time this comes up, keep this issue as evidence
(10:27:40 CET) Evolution: vorburger: so your issue is that 181-3 isn't in the base repos anymore
(10:27:52 CET) billings: Evolution: yeah, we've told him that
(10:28:34 CET) vorburger: Evolution: yeah, but I'm not complaining, I'm ditching that minor version number right now; it was just confusing, I thought these packages were there "forever" - learning thanks to you guys, thanks again
(10:29:12 CET) Evolution: vorburger: the packages move to vault, so you *can* pin, but you shouldn't.
(10:29:23 CET) Evolution: because vault doesn't get updates ever. it's just where old packages go to die
(10:30:13 CET) gdb: I still believe Red Hat made a mistake going from the versioning scheme in RHEL 4 to the one used in RHEL 5 and beyond. RHEL 4 and before was versioned liked Solaris (i.e.; Solaris 10 Update 9). No one cared about the Update level other than "whatever is current" because "it's still Solaris 10". When Red Hat moved to having minor versions instead of "updates" people assume that it's a specific version which it's not. The version numbers are *misleading*. And
(10:30:34 CET) vorburger: Evolution: right but what I'm learning here is that "shops have to pin to a specific version for compliance reasons" are being cheated ;) as, apparently, there really is no such thing as 7.5 because as soon as you yum install, not even update, you get 7.6 anyway, based on what I just learnthere
(10:31:23 CET) Evolution: it's not cheating so much as deliberate self-delusion.
(10:31:46 CET) Evolution: but you're right, we *only* support the current major version.
(10:31:54 CET) Evolution: if you want support for older stuff, pay RH.
(10:32:30 CET) gdb: I hate to wait, like, a day, for the zol project to release ther kabi drivers for 7.6. Then I updated later that evening.
(10:32:42 CET) gdb: er had to wait like*
(10:32:47 CET) vorburger: Evolution: I'm fully onboard with that - I happen to wear the same red hat at work as I'm assuming you are ;-)
(10:33:12 CET) vorburger: Evolution: I just was not aware that's how it actually works, so thanks for teaching me!
(10:36:38 CET) Evolution: vorburger: indeed.
(10:37:04 CET) Evolution: vorburger: I'd like to help, but I'm not sure I fully understand the issue
(10:39:00 CET) vorburger: Evolution: no I'm good! No further help needed, you guys here were really helpful. The mistake was that that project used a fixed minor version number, which I've just removed in https://github.com/fabric8io-images/s2i/commit/b57b0dfe06847e6dbe0b7bc46f9851cd9960ed71
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment