Buildah: can't build image with buildah installed successfully

[QincaiLiu]

Now I am running to create an image as builder in jenkins which includes buildah installed. My idea is to have this image in pod template and use kubernetes plugin in jenkins to create pod using this builder image, and create related image for products.

The Dockerfile I used to build the image is like:

FROM gcr.io/jenkinsxio/builder-go:0.1.451

RUN yum -y update libseccomp-2.3.1-4

RUN cd /etc/yum.repos.d/ \
   && wget https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/CentOS_7/devel:kubic:libcontainers:stable.repo

RUN yum -y install buildah

But it always failed with

.....
---> Package python-IPy.noarch 0:0.75-6.el7 will be installed
---> Package setools-libs.x86_64 0:3.3.8-4.el7 will be installed
--> Finished Dependency Resolution
Error: Package: buildah-1.14.9-1.el7.x86_64 (devel_kubic_libcontainers_stable)
           Requires: crun >= 0.10-1
Error: Package: buildah-1.14.9-1.el7.x86_64 (devel_kubic_libcontainers_stable)
           Requires: libseccomp >= 2.4.1-0
           Available: libseccomp-2.3.1-4.el7.i686 (base)
               libseccomp = 2.3.1-4.el7
 You could try using --skip-broken to work around the problem
 You could try running: rpm -Va --nofiles --nodigest
The command '/bin/sh -c yum -y install buildah' returned a non-zero code: 1

lt seems that libseccomp can be installed successfully with yum, but it failed for crun with seperate installing like in the Dockerfile.

I tried to use --skip-broken and rpm -Va --nofiles --nodigest, neither works.
Can you give me some advice here?

Thanks

[greatjob-hub]

I have a similar issue when trying to install buildah.

--> Finished Dependency Resolution
Error: Package: buildah-1.14.9-1.el7.x86_64 (devel_kubic_libcontainers_stable)
Requires: crun >= 0.10-1
Error: Package: buildah-1.14.9-1.el7.x86_64 (devel_kubic_libcontainers_stable)
Requires: libseccomp >= 2.4.1-0
Installed: libseccomp-2.3.1-4.el7.x86_64 (@cha-centos-7server-x86_64-cloned-20200501)
libseccomp = 2.3.1-4.el7
Available: libseccomp-2.2.1-1.el7.i686 (cha-centos-7server-x86_64-cloned-20200601)
libseccomp = 2.2.1-1.el7
Available: libseccomp-2.3.1-2.el7.i686 (cha-centos-7server-x86_64-cloned-20200601)
libseccomp = 2.3.1-2.el7
Available: libseccomp-2.3.1-3.el7.i686 (cha-centos-7server-x86_64-cloned-20200601)
libseccomp = 2.3.1-3.el7
You could try using --skip-broken to work around the problem
You could try running: rpm -Va --nofiles --nodigest

I triedthe option --skip-broken, but didn't work either.

[rhatdan]

@jnovy @lsm5 Any ideas here. Looks like we have a bad spec file requiring crun rather then runc?

[QincaiLiu]

now I used another repo library, seems buildah can be installed successfully, the loaded another libraray:
RUN cd /etc/yum.repos.d/ \
&& wget https://build.opensuse.org/project/show/devel:kubic:libcontainers:stable

But when I tried to "docker run" with the built image,
$ docker run -it test bash
$ vi Dockerfile
From alpine
ENTRYPOINT ["/bin/sh", "-c"]
CMD ["while true; do sleep 2 ; echo hello world from Img build!; done"]

$ buildah bud --no-cache=true -t hello-buildah:0.0.1 .
Error during unshare(CLONE_NEWUSER): Operation not permitted
ERRO error parsing PID "": strconv.Atoi: parsing "": invalid syntax
ERRO (unable to determine exit status)
$ exit
exit
$ docker run --privileged -it test bash
$ vi Dockerfile
$ buildah bud --no-cache=true -t hello-buildah:0.0.1 .
ERRO 'overlay' is not supported over aufs
'overlay' is not supported over aufs: backing file system is unsupported for this graph driver

[greatjob-hub]

I removed "devel:kubic:libcontainers:stable.repo" from /etc/yum.repos.d/

Then did "yum -y install buildah"

Buildah installed successfully

[QincaiLiu]

I removed "devel:kubic:libcontainers:stable.repo" from /etc/yum.repos.d/

Then did "yum -y install buildah"

Buildah installed successfully

can you use buildah to build docker image inside the container? with privilege or without privilege?

[rhatdan]

We call them container images, but yes, you can build container images with a locked down container.

https://developers.redhat.com/blog/2019/08/14/best-practices-for-running-buildah-in-a-container/

[greatjob-hub]

@QincaiLiu Sorry, I didn't try

[greatjob-hub]

I think that it is not the topic of this issue but when trying to excecute

yum install --installroot $scratchmnt --releasever 30 bash coreutils --setopt install_weak_deps=false -y

(Tutorial 1 Buildah)

I got this:

oaded plugins: fastestmirror, langpacks, rhnplugin
This system is receiving updates from RHN Classic or Red Hat Satellite.
Main config did not have a install_weak_deps attr. before setopt

You have enabled checking of packages via GPG keys. This is a good thing.
However, you do not have any GPG public keys installed. You need to download
the keys for packages you wish to install and install them.
You can do that by running the command:
rpm --import public.gpg.key

Alternatively you can specify the url to the key you would like to use
for a repository in the 'gpgkey' option in a repository section and yum
will install it for you.

For more information contact your distribution or package provider.

Problem repository: cha-centos-7-x86_64

[rhatdan]

This should be opened as a bugzilla not an issue for the upstream.