{"id":38785,"date":"2019-10-31T22:25:55","date_gmt":"2019-10-31T19:25:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera\/"},"modified":"2019-10-31T22:25:55","modified_gmt":"2019-10-31T19:25:55","slug":"rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","title":{"rendered":"Doporu\u010den\u00ed pro spu\u0161t\u011bn\u00ed Buildahu uvnit\u0159 kontejneru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jak\u00e9 v\u00fdhody p\u0159in\u00e1\u0161\u00ed rozlo\u017een\u00ed prost\u0159ed\u00ed pro spou\u0161t\u011bn\u00ed kontejner\u016f na jednotliv\u00e9 n\u00e1stroje? P\u0159edev\u0161\u00edm to, \u017ee tyto n\u00e1stroje lze kombinovat tak, aby se navz\u00e1jem chr\u00e1nily.<\/p>\n

\"Doporu\u010den\u00ed
\n
\nMnoh\u00e9 l\u00e1k\u00e1 my\u0161lenka prov\u00e1d\u011bt sestaven\u00ed kontejnerov\u00fdch OCI obraz\u016f v r\u00e1mci Kubernetes<\/a><\/noindex> nebo podobn\u00e9ho syst\u00e9mu. P\u0159edstavme si, \u017ee m\u00e1me CI\/CD, kter\u00e9 neust\u00e1le vytv\u00e1\u0159\u00ed obrazy, pak n\u011bco jako Red Hat OpenShift<\/a><\/noindex>\/Kubernetes \u0431\u044b\u043b\u043e \u0431\u044b \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435. \u0414\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u043f\u043e\u0440 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043b\u044e\u0434\u0435\u0439 \u043f\u0440\u043e\u0441\u0442\u043e \u0434\u0430\u0432\u0430\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a Docker-\u0441\u043e\u043a\u0435\u0442\u0443 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 docker build. P\u0159ed n\u011bkolika lety jsme ji\u017e uk\u00e1zali<\/a><\/noindex>, \u017ee to je velmi nebezpe\u010dn\u00e9, vlastn\u011b je to je\u0161t\u011b hor\u0161\u00ed ne\u017e d\u00e1vat bez hesla root nebo sudo.
\n<\/a><\/noindex>
\nProto se lid\u00e9 neust\u00e1le pokou\u0161ej\u00ed spou\u0161t\u011bt Buildah v kontejneru. Zkr\u00e1tka, vytvo\u0159ili jsme p\u0159\u00edklad<\/a><\/noindex> jak, podle na\u0161eho n\u00e1zoru, nejl\u00e9pe spou\u0161t\u011bt Buildah uvnit\u0159 kontejneru, a nahr\u00e1li jsme p\u0159\u00edslu\u0161n\u00e9 obrazy na quay.io\/buildah<\/a><\/noindex>. Poj\u010fme na to\u2026<\/p>\n

Nastaven\u00ed<\/h3>\n

\nTyto obrazy jsou sestaveny z Dockerfiles, kter\u00e9 lze nal\u00e9zt v repozit\u00e1\u0159i Buildah ve slo\u017ece buildahimage<\/a><\/noindex>.
\nZde se pod\u00edv\u00e1me na stabiln\u00ed verzi Dockerfile<\/a><\/noindex>.<\/p>\n

# stable\/Dockerfile\n#\n# Build a Buildah container image from the latest\n# stable version of Buildah on the Fedoras Updates System.\n# https:\/\/bodhi.fedoraproject.org\/updates\/?search=buildah\n# This image can be used to create a secured container\n# that runs safely with privileges within the container.\n#\nFROM fedora:latest\n\n# Don't include container-selinux and remove\n# directories used by dnf that are just taking\n# up space.\nRUN yum -y install buildah fuse-overlayfs --exclude container-selinux; rm -rf \/var\/cache \/var\/log\/dnf* \/var\/log\/yum.*\n\n# Adjust storage.conf to enable Fuse storage.\nRUN sed -i -e 's|^#mount_program|mount_program|g' -e '\/additionalimage.*\/a \"\/var\/lib\/shared\",' \/etc\/containers\/storage.conf\n<\/code><\/pre>\n
\nM\u00edsto OverlayFS, implementovan\u00e9ho na \u00farovni j\u00e1dra Linuxu hostitele, pou\u017e\u00edv\u00e1me uvnit\u0159 kontejneru program fuse-overlay<\/a><\/noindex>, proto\u017ee v sou\u010dasn\u00e9 dob\u011b m\u016f\u017ee OverlayFS prov\u00e1d\u011bt mont\u00e1\u017e pouze s pravomocemi SYS_ADMIN prost\u0159ednictv\u00edm linuxov\u00fdch schopnost\u00ed. A my chceme spou\u0161t\u011bt na\u0161e Buildah kontejnery bez jak\u00fdchkoli privilegovan\u00fdch pr\u00e1v. Fuse-overlay funguje velmi rychle a m\u00e1 lep\u0161\u00ed v\u00fdkon ne\u017e storage driver VFS. V\u0161imn\u011bte si, \u017ee p\u0159i spu\u0161t\u011bn\u00ed Buildah kontejneru, kter\u00fd pou\u017e\u00edv\u00e1 Fuse, je nutn\u00e9 poskytnout za\u0159\u00edzen\u00ed \/dev\/fuse.<\/p>\n
podman run --device \/dev\/fuse quay.io\/buildahctr ...\nRUN mkdir -p \/var\/lib\/shared\/overlay-images \/var\/lib\/shared\/overlay-layers; touch \/var\/lib\/shared\/overlay-images\/images.lock; touch \/var\/lib\/shared\/overlay-layers\/layers.lock\n<\/code><\/pre>\n
\nD\u00e1le vytvo\u0159\u00edme katalog pro dodate\u010dn\u00e1 \u00falo\u017ei\u0161t\u011b. Container\/storage<\/a><\/noindex> podporuje koncept p\u0159ipojen\u00ed dodate\u010dn\u00fdch read-only \u00falo\u017ei\u0161\u0165 obraz\u016f. Nap\u0159\u00edklad lze nastavit overlay storage area na jednom stroji a pot\u00e9 prost\u0159ednictv\u00edm NFS p\u0159ipojit toto \u00falo\u017ei\u0161t\u011b na jin\u00e9m stroji a pou\u017e\u00edvat obrazy z n\u011bj bez stahov\u00e1n\u00ed p\u0159es pull. Toto \u00falo\u017ei\u0161t\u011b pot\u0159ebujeme, abychom mohli p\u0159ipojit jako svazek n\u011bjak\u00e9 \u00falo\u017ei\u0161t\u011b obraz\u016f z hostitele a pou\u017e\u00edvat je uvnit\u0159 kontejneru.<\/p>\n
# Set up environment variables to note that this is\n# not starting with user namespace and default to\n# isolate the filesystem with chroot.\nENV _BUILDAH_STARTED_IN_USERNS=\"\" BUILDAH_ISOLATION=chroot\n<\/code><\/pre>\n
\nA nakonec, pomoc\u00ed prom\u011bnn\u00e9 prost\u0159ed\u00ed BUILDAH_ISOLATION \u0159\u00edk\u00e1me, \u017ee kontejnery Buildah by m\u011bly b\u00fdt ve v\u00fdchoz\u00edm nastaven\u00ed spou\u0161t\u011bny s izolac\u00ed chroot. Dal\u0161\u00ed izolace zde nen\u00ed pot\u0159eba, proto\u017ee u\u017e pracujeme v kontejneru. Aby Buildah vytv\u00e1\u0159el sv\u00e9 vlastn\u00ed kontejnery se sd\u00edlen\u00edm jmenov\u00fdch prostor\u016f, je pot\u0159eba privilegium SYS_ADMIN, co\u017e znamen\u00e1, \u017ee budeme muset uvolnit pravidla SELinux a SECCOMP pro kontejner, co\u017e je v rozporu s na\u0161\u00edm nastaven\u00edm prov\u00e1d\u011bt sestaven\u00ed ze zabezpe\u010den\u00e9ho kontejneru.<\/p>\n
Spou\u0161t\u00edme Buildah uvnit\u0159 kontejneru<\/h3>\n
\nNa sch\u00e9matu obrazu kontejneru Buildah uveden\u00e9m v\u00fd\u0161e lze flexibiln\u011b variabilizovat zp\u016fsoby spu\u0161t\u011bn\u00ed t\u011bchto kontejner\u016f.<\/p>\n
Rychlost versus bezpe\u010dnost<\/h4>\n
\nPo\u010d\u00edta\u010dov\u00e1 bezpe\u010dnost je v\u017edy kompromis mezi rychlost\u00ed proveden\u00ed procesu a t\u00edm, kolik ochrany je kolem toho na\u0159izov\u00e1no. Toto tvrzen\u00ed plat\u00ed i p\u0159i sestavov\u00e1n\u00ed kontejner\u016f, proto se n\u00ed\u017ee pod\u00edv\u00e1me na mo\u017enosti tohoto kompromisu.<\/p>\n
V\u00fd\u0161e uveden\u00fd obrazu kontejneru bude uchov\u00e1vat sv\u00e9 \u00falo\u017ei\u0161t\u011b v \/var\/lib\/containers. Proto mus\u00edme podmountovat obsah do t\u00e9to slo\u017eky, a zp\u016fsob, jak\u00fdm to ud\u011bl\u00e1me, bude m\u00edt zna\u010dn\u00fd vliv na rychlost sestavov\u00e1n\u00ed kontejnerov\u00fdch obraz\u016f.<\/p>\n
Pod\u00edvejme se na t\u0159i varianty.<\/p>\n
Varianta 1.<\/b> Pokud je vy\u017eadov\u00e1na maxim\u00e1ln\u00ed bezpe\u010dnost, m\u016f\u017ee b\u00fdt pro ka\u017ed\u00fd kontejner vytvo\u0159ena vlastn\u00ed slo\u017eka pro containers\/image a p\u0159ipojena ke kontejneru prost\u0159ednictv\u00edm volume-mount. Krom\u011b toho lze um\u00edstit kontextov\u00fd adres\u00e1\u0159 p\u0159\u00edmo do kontejneru, do slo\u017eky \/build:<\/p>\n
# mkdir \/var\/lib\/containers1\n# podman run -v .\/build:\/build:z -v \/var\/lib\/containers1:\/var\/lib\/containers:Z quay.io\/buildah\/stable\nbuildah  -t image1 bud \/build\n# podman run -v \/var\/lib\/containers1:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah  push  image1 registry.company.com\/myuser\n# rm -rf \/var\/lib\/containers1\n<\/code><\/pre>\n
\nBezpe\u010dnost.<\/i> Pr\u00e1ce v takov\u00e9m kontejneru Buildah zaji\u0161\u0165uje maxim\u00e1ln\u00ed bezpe\u010dnost: nedost\u00e1v\u00e1 \u017e\u00e1dn\u00e1 root opr\u00e1vn\u011bn\u00ed prost\u0159ednictv\u00edm capabilities a jsou na n\u011bj aplikov\u00e1na v\u0161echna omezen\u00ed SECOMP a SELinux. Takov\u00fd kontejner lze dokonce spustit s izolac\u00ed User Namespace, p\u0159id\u00e1n\u00edm mo\u017enosti jako je --uidmap 0:100000:10000.<\/p>\n
V\u00fdkon.<\/i> V\u00fdkon je zde v\u0161ak minim\u00e1ln\u00ed, proto\u017ee jak\u00e9koli obrazy z kontejnerov\u00fdch registr\u016f jsou v\u017edy znovu kop\u00edrov\u00e1ny na hostitele a ke\u0161ov\u00e1n\u00ed nefunguje v\u016fbec. Po dokon\u010den\u00ed sv\u00e9 pr\u00e1ce mus\u00ed Buildah-kontejner poslat obraz do registru a vymazat obsah na hostiteli. Kdy\u017e se kontejnerov\u00fd obraz bude p\u0159\u00ed\u0161t\u011b sestavovat, bude t\u0159eba ho znovu st\u00e1hnout z registru, proto\u017ee na hostiteli do t\u00e9 doby u\u017e nic nez\u016fstane.<\/p>\n
Varianta 2.<\/b> Pokud je pot\u0159eba v\u00fdkon na \u00farovni Dockeru, je mo\u017en\u00e9 podmountovat container\/storage hostitele p\u0159\u00edmo do kontejneru.<\/p>\n
# podman run -v .\/build:\/build:z -v \/var\/lib\/containers:\/var\/lib\/containers --security-opt label:disabled quay.io\/buildah\/stable buildah  -t image2 bud \/build\n# podman run -v \/var\/lib\/containers:\/var\/lib\/containers --security-opt label:disabled  quay.io\/buildah\/stable buildah push image2 registry.company.com\/myuser\n<\/code><\/pre>\n
\nBezpe\u010dnost.<\/i> Toto je nejm\u00e9n\u011b bezpe\u010dn\u00fd zp\u016fsob sestaven\u00ed kontejner\u016f, proto\u017ee kontejner m\u00e1 povolen\u00ed modifikovat \u00falo\u017ei\u0161t\u011b na hostitelsk\u00e9m syst\u00e9mu, co\u017e m\u016f\u017ee potenci\u00e1ln\u011b umo\u017enit vlo\u017eit Podmanu nebo CRI-O \u0161kodliv\u00fd obraz. Krom\u011b toho je nutn\u00e9 vypnout separaci SELinux, aby procesy v Buildah kontejneru mohly interagovat s \u00falo\u017ei\u0161t\u011bm na hostiteli. V\u0161imn\u011bte si, \u017ee tato mo\u017enost je st\u00e1le lep\u0161\u00ed ne\u017e Docker socket, proto\u017ee kontejner je blokov\u00e1n zb\u00fdvaj\u00edc\u00edmi bezpe\u010dnostn\u00edmi funkcemi a nem\u016f\u017ee jen tak vz\u00edt a spustit n\u011bjak\u00fd kontejner na hostiteli.<\/p>\n
V\u00fdkon.<\/i> Zde je to maxim\u00e1ln\u00ed, proto\u017ee je pln\u011b vyu\u017e\u00edv\u00e1no caching. Pokud Podman nebo CRI-O ji\u017e st\u00e1hli pot\u0159ebn\u00fd obraz na hostitelsk\u00e9m syst\u00e9mu, pak proces Buildah uvnit\u0159 kontejneru nebude muset stahovat znovu, a n\u00e1sledn\u00e9 sestavy na z\u00e1klad\u011b tohoto obrazu tak\u00e9 mohou vz\u00edt, co pot\u0159ebuj\u00ed, z cache.<\/p>\n
Mo\u017enost 3.<\/b> Podstatou tohoto zp\u016fsobu je kombinovat n\u011bkolik obraz\u016f do jednoho projektu se spole\u010dnou slo\u017ekou pro kontejnerov\u00e9 obrazy.<\/p>\n
# mkdir \/var\/lib\/project3\n# podman run --security-opt label_level=s0:C100, C200 -v .\/build:\/build:z \n-v \/var\/lib\/project3:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah  -t image3 bud \/build\n# podman run --security-opt label_level=s0:C100, C200 \n-v \/var\/lib\/project3:\/var\/lib\/containers quay.io\/buildah\/stable buildah push image3  registry.company.com\/myuser\n<\/code><\/pre>\n
\nV tomto p\u0159\u00edkladu mezit\u00edm nesma\u017eeme slo\u017eku projektu (\/var\/lib\/project3) mezi spu\u0161t\u011bn\u00edmi, tak\u017ee v\u0161echny n\u00e1sleduj\u00edc\u00ed sestavy v r\u00e1mci projektu vyu\u017e\u00edvaj\u00ed v\u00fdhod caching.<\/p>\n
Bezpe\u010dnost.<\/i> N\u011bco mezi mo\u017enostmi 1 a 2. Na jedn\u00e9 stran\u011b kontejnery nemaj\u00ed p\u0159\u00edstup k obsahu na hostiteli a tud\u00ed\u017e nemohou vlo\u017eit n\u011bco \u0161patn\u00e9ho do \u00falo\u017ei\u0161t\u011b obraz\u016f Podman\/CRI-O. Na druh\u00e9 stran\u011b v r\u00e1mci sv\u00e9ho projektu m\u016f\u017ee kontejner zasahovat do sestaven\u00ed jin\u00fdch kontejner\u016f.<\/p>\n
V\u00fdkon.<\/i> Tady je to hor\u0161\u00ed ne\u017e p\u0159i pou\u017eit\u00ed spole\u010dn\u00e9ho cache na \u00farovni hostitele, proto\u017ee nelze pou\u017e\u00edt obrazy, kter\u00e9 byly d\u0159\u00edve sta\u017eeny pomoc\u00ed Podman\/CRI-O. Nicm\u00e9n\u011b pot\u00e9, co Buildah st\u00e1hne obraz, lze tento obraz vyu\u017e\u00edt v jak\u00fdchkoli n\u00e1sledn\u00fdch sestav\u00e1ch v r\u00e1mci projektu.<\/p>\n
Dal\u0161\u00ed \u00falo\u017ei\u0161t\u011b<\/h4>\n
\nV containers\/storage<\/a><\/noindex> Existuje skv\u011bl\u00e1 v\u011bc jako dodate\u010dn\u00e9 \u00falo\u017ei\u0161t\u011b (additional stores), d\u00edky kter\u00e9 p\u0159i spu\u0161t\u011bn\u00ed a sestaven\u00ed kontejner\u016f mohou kontejnerov\u00e9 enginy pou\u017e\u00edvat extern\u00ed \u00falo\u017ei\u0161t\u011b obraz\u016f v re\u017eimu pouze pro \u010dten\u00ed overlay. V podstat\u011b lze do souboru storage.conf p\u0159idat jedno nebo v\u00edce \u00falo\u017ei\u0161\u0165 \"pouze pro \u010dten\u00ed\", aby kontejnerov\u00fd engine p\u0159i spu\u0161t\u011bn\u00ed kontejneru hledal pot\u0159ebn\u00fd obraz v t\u011bchto \u00falo\u017ei\u0161t\u00edch. P\u0159i\u010dem\u017e obraz si st\u00e1hne z registru pouze v p\u0159\u00edpad\u011b, \u017ee jej nenajde v \u017e\u00e1dn\u00e9m z t\u011bchto \u00falo\u017ei\u0161\u0165. Kontejnerov\u00fd engine bude moci zapisovat pouze do dostupn\u00fdch \u00falo\u017ei\u0161\u0165 pro z\u00e1pis\u2026<\/p>\n
Pokud posuneme nahoru a pod\u00edv\u00e1me se na Dockerfile, kter\u00fd pou\u017e\u00edv\u00e1me pro sestaven\u00ed obrazu quay.io\/buildah\/stable, tak tam jsou takov\u00e9to \u0159\u00e1dky:<\/p>\n
# Adjust storage.conf to enable Fuse storage.\nRUN sed -i -e 's|^#mount_program|mount_program|g' -e '\/additionalimage.*\/a \"\/var\/lib\/shared\",' \/etc\/containers\/storage.conf\nRUN mkdir -p \/var\/lib\/shared\/overlay-images \/var\/lib\/shared\/overlay-layers; touch \/var\/lib\/shared\/overlay-images\/images.lock; touch \/var\/lib\/shared\/overlay-layers\/layers.lock\n<\/code><\/pre>\n
\nV prvn\u00edm \u0159\u00e1dku modifikujeme \/etc\/containers\/storage.conf uvnit\u0159 kontejnerov\u00e9ho obrazu, \u0159\u00edk\u00e1me storage driveru, aby pou\u017e\u00edval \"additionalimagestores\" v adres\u00e1\u0159i \/var\/lib\/shared. A v n\u00e1sleduj\u00edc\u00edm \u0159\u00e1dku vytv\u00e1\u0159\u00edme sd\u00edlenou slo\u017eku a p\u0159id\u00e1v\u00e1me p\u00e1r soubor\u016f s uzam\u010den\u00edm, aby nedoch\u00e1zelo k probl\u00e9m\u016fm ze strany containers\/storage. V podstat\u011b pouze vytv\u00e1\u0159\u00edme pr\u00e1zdn\u00e9 \u00falo\u017ei\u0161t\u011b kontejnerov\u00fdch obraz\u016f. <\/p>\n
Pokud namontujeme containers\/storage o \u00farove\u0148 v\u00fd\u0161 ne\u017e tato slo\u017eka, Buildah bude moci pou\u017e\u00edvat obr\u00e1zky.<\/p>\n
Nyn\u00ed se vra\u0165me k v\u00fd\u0161e uveden\u00e9 variant\u011b 2, kdy Buildah kontejner m\u016f\u017ee \u010d\u00edst a zapisovat do containers\/store na hostitel\u00edch, a tedy m\u00e1 maxim\u00e1ln\u00ed v\u00fdkon d\u00edky ukl\u00e1d\u00e1n\u00ed obraz\u016f na \u00farovni Podman\/CRI-O, ale m\u00e1 minim\u00e1ln\u00ed bezpe\u010dnost, proto\u017ee m\u016f\u017ee ps\u00e1t p\u0159\u00edmo do \u00falo\u017ei\u0161\u0165. A nyn\u00ed p\u0159id\u00e1me dodate\u010dn\u00e1 \u00falo\u017ei\u0161t\u011b a dostaneme to nejlep\u0161\u00ed z obou sv\u011bt\u016f.<\/p>\n
# mkdir \/var\/lib\/containers4\n# podman run -v .\/build:\/build:z -v \/var\/lib\/containers\/storage:\/var\/lib\/shared:ro -v  \/var\/lib\/containers4:\/var\/lib\/containers:Z  quay.io\/buildah\/stable \n buildah  -t image4 bud \/build\n# podman run -v \/var\/lib\/containers\/storage:\/var\/lib\/shared:ro  \n-v >\/var\/lib\/containers4:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah push image4  registry.company.com\/myuser\n# rm -rf \/var\/lib\/continers4\n<\/code><\/pre>\n
\nV\u0161imn\u011bte si, \u017ee \/var\/lib\/containers\/storage hostitele je namontov\u00e1no do \/var\/lib\/shared uvnit\u0159 kontejneru v re\u017eimu pouze pro \u010dten\u00ed. Proto p\u0159i pr\u00e1ci v kontejneru m\u016f\u017ee Buildah pou\u017e\u00edvat jak\u00e9koli obr\u00e1zky, kter\u00e9 byly ji\u017e d\u0159\u00edve sta\u017eeny prost\u0159ednictv\u00edm Podman\/CRI-O (ahoj, rychlost), ale ps\u00e1t m\u016f\u017ee pouze do sv\u00e9ho vlastn\u00edho \u00falo\u017ei\u0161t\u011b (ahoj, bezpe\u010dnost). Tak\u00e9 si v\u0161imn\u011bte, \u017ee to prob\u00edh\u00e1 bez vypnut\u00ed odd\u011blen\u00ed SELinux pro kontejner.<\/p>\n
D\u016fle\u017eit\u00fd aspekt<\/h4>\n
\nV \u017e\u00e1dn\u00e9m p\u0159\u00edpad\u011b nelze odstra\u0148ovat \u017e\u00e1dn\u00e9 obr\u00e1zky z pod\u0159\u00edzen\u00e9ho \u00falo\u017ei\u0161t\u011b. Jinak m\u016f\u017ee Buildah kontejner selhat.<\/p>\n
A to rozhodn\u011b nejsou v\u0161echny v\u00fdhody<\/h4>\n
\nMo\u017enosti dodate\u010dn\u00fdch \u00falo\u017ei\u0161\u0165 nejsou omezeny pouze na v\u00fd\u0161e popsan\u00fd sc\u00e9n\u00e1\u0159. Nap\u0159\u00edklad lze um\u00edstit v\u0161echny kontejnerov\u00e9 obrazy do spole\u010dn\u00e9ho s\u00ed\u0165ov\u00e9ho \u00falo\u017ei\u0161t\u011b a poskytnout k n\u011bmu p\u0159\u00edstup v\u0161em Buildah kontejner\u016fm. \u0158ekn\u011bme, \u017ee m\u00e1me stovky obraz\u016f, kter\u00e9 n\u00e1\u0161 syst\u00e9m CI\/CD pravideln\u011b pou\u017e\u00edv\u00e1 k sestaven\u00ed kontejnerov\u00fdch obraz\u016f. Soust\u0159ed\u00edme v\u0161echny tyto obrazy na jednom hostitelsk\u00e9m \u00falo\u017ei\u0161ti a pot\u00e9, pomoc\u00ed preferovan\u00fdch prost\u0159edk\u016f s\u00ed\u0165ov\u00e9ho \u00falo\u017ei\u0161t\u011b (NFS, Gluster, Ceph, ISCSI, S3\u2026), otev\u0159eme spole\u010dn\u00fd p\u0159\u00edstup k tomuto \u00falo\u017ei\u0161ti v\u0161em uzl\u016fm Buildah nebo Kubernetes.<\/p>\n
Nyn\u00ed sta\u010d\u00ed p\u0159imontovat toto s\u00ed\u0165ov\u00e9 \u00falo\u017ei\u0161t\u011b do kontejneru Buildah na \/var\/lib\/shared a to je v\u0161echno \u2013 kontejner\u016fm Buildah u\u017e nebude pot\u0159eba stahovat obrazy prost\u0159ednictv\u00edm pull. T\u00edmto zp\u016fsobem vynech\u00e1v\u00e1me f\u00e1zi p\u0159edb\u011b\u017en\u00e9ho napln\u011bn\u00ed (pre-population) a jsme ihned p\u0159ipraveni nasazovat kontejnery.<\/p>\n
A samoz\u0159ejm\u011b, to lze pou\u017e\u00edt v r\u00e1mci st\u00e1vaj\u00edc\u00edho syst\u00e9mu Kubernetes nebo kontejnerov\u00e9 infrastruktury, aby bylo mo\u017en\u00e9 spou\u0161t\u011bt a vykon\u00e1vat kontejnery kdekoli bez jak\u00e9hokoli stahov\u00e1n\u00ed obraz\u016f prost\u0159ednictv\u00edm pull. Nav\u00edc m\u016f\u017ee registr kontejner\u016f, kter\u00fd obdr\u017e\u00ed push po\u017eadavek na nahr\u00e1n\u00ed aktualizovan\u00e9ho obrazu, automaticky odeslat tento obraz do spole\u010dn\u00e9ho s\u00ed\u0165ov\u00e9ho \u00falo\u017ei\u0161t\u011b, kde je ihned dostupn\u00fd v\u0161em uzl\u016fm.<\/p>\n
Velikosti kontejnerov\u00fdch obraz\u016f mohou n\u011bkdy dosahovat n\u011bkolika gigabajt\u016f. Funkce dodate\u010dn\u00fdch \u00falo\u017ei\u0161\u0165 umo\u017e\u0148uje obej\u00edt klonov\u00e1n\u00ed t\u011bchto obraz\u016f po uzlech a \u010din\u00ed spu\u0161t\u011bn\u00ed kontejner\u016f prakticky okam\u017eit\u00fdm.<\/p>\n
Krom\u011b toho v sou\u010dasnosti pracujeme na nov\u00e9 funkce montov\u00e1n\u00ed overlay volume, kter\u00e1 je\u0161t\u011b v\u00edce urychl\u00ed sestavov\u00e1n\u00ed kontejner\u016f.<\/p>\n
Z\u00e1v\u011br<\/h3>\n
\nProv\u00e1d\u011bt Buildah uvnit\u0159 kontejneru v prost\u0159ed\u00ed Kubernetes\/CRI-O, Podman nebo dokonce v Dockeru je zcela re\u00e1ln\u00e9, nav\u00edc je to jednoduch\u00e9 a mnohem bezpe\u010dn\u011bj\u0161\u00ed ne\u017e pou\u017e\u00edvat docker.socket. V\u00fdrazn\u011b jsme zv\u00fd\u0161ili flexibilitu pr\u00e1ce s obrazy, a nyn\u00ed je m\u016f\u017eete spou\u0161t\u011bt r\u016fzn\u00fdmi zp\u016fsoby pro optim\u00e1ln\u00ed rovnov\u00e1hu mezi bezpe\u010dnost\u00ed a v\u00fdkonem.<\/p>\n
Funkce dodate\u010dn\u00fdch \u00falo\u017ei\u0161\u0165 umo\u017e\u0148uje urychlit nebo dokonce zcela odstranit stahov\u00e1n\u00ed obraz\u016f na uzly.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0447\u0435\u043c \u043f\u0440\u0435\u043b\u0435\u0441\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435? \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043a\u043e\u043c\u0431\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043e\u043d\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u043b\u0438 \u0434\u0440\u0443\u0433 \u0434\u0440\u0443\u0433\u0430. \u041c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0438\u0434\u0435\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0441\u0431\u043e\u0440\u043a\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 OCI-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Kubernetes \u0438\u043b\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0414\u043e\u043f\u0443\u0441\u0442\u0438\u043c, \u0443 \u043d\u0430\u0441 \u0435\u0441\u0442\u044c CI\/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b, \u0442\u043e\u0433\u0434\u0430 \u0447\u0442\u043e-\u0442\u043e \u0442\u0438\u043f\u0430 Red Hat OpenShift\/Kubernetes \u0431\u044b\u043b\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38785","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Doporu\u010den\u00ed pro spu\u0161t\u011bn\u00ed Buildah uvnit\u0159 kontejneru | ProHoster","description":"Jak\u00e9 jsou v\u00fdhody rozd\u011blen\u00ed prost\u0159ed\u00ed pro b\u011bh kontejner\u016f na jednotliv\u00e9 n\u00e1stroje?","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0443 Buildah \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u0447\u0435\u043c \u043f\u0440\u0435\u043b\u0435\u0441\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435?","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:25:55+00:00","article:modified_time":"2019-10-31T19:25:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38785","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:03:14","updated":"2026-01-23 23:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=38785"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38785\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/29093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=38785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=38785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=38785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}