{"id":38785,"date":"2019-10-31T22:25:55","date_gmt":"2019-10-31T19:25:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera\/"},"modified":"2019-10-31T22:25:55","modified_gmt":"2019-10-31T19:25:55","slug":"rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","title":{"rendered":"Soovitused Buildah'i k\u00e4ivitamiseks konteineris","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mis on konteinerite t\u00f6\u00f6keskkonna eraldamise ilu? Eelk\u00f5ige see, et neid t\u00f6\u00f6riistu saab alustada kombineerima, et nad \u00fcksteist kaitseksid.<\/p>\n

\"Soovitused
\n
\nPaljusid paelub idee koostada konteinerite OCI-pilte raames Kubernetes<\/a><\/noindex> v\u00f5i sarnase s\u00fcsteemi kaudu. Oletame, et meil on CI\/CD, mis pidevalt genereerib pilte, siis midagi sarnast Red Hat OpenShift<\/a><\/noindex>\/Kubernetes \u0431\u044b\u043b\u043e \u0431\u044b \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435. \u0414\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u043f\u043e\u0440 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043b\u044e\u0434\u0435\u0439 \u043f\u0440\u043e\u0441\u0442\u043e \u0434\u0430\u0432\u0430\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a Docker-\u0441\u043e\u043a\u0435\u0442\u0443 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 docker build. Oleme juba mitu aastat tagasi n\u00e4idanud<\/a><\/noindex>, et see on v\u00e4ga ebaohutu, tegelikult on see isegi hullem kui anda paroolita root v\u00f5i sudo.
\n<\/a><\/noindex>
\nSeet\u00f5ttu p\u00fc\u00fcavad inimesed pidevalt k\u00e4ivitada Buildah'i konteineris. L\u00fchidalt \u00f6eldes, oleme loonud an example<\/a><\/noindex> seda, kuidas meie meelest on parim k\u00e4ivitada Buildah konteineris, ja oleme vastavad pildid \u00fcles laadinud quay.io\/buildah<\/a><\/noindex>. Alustame\u2026<\/p>\n

Seadistamine<\/h3>\n

\nNeed pildid on loodud Dockerfile'idest, mida saab leida Buildah hoidlast kaustas buildahimage<\/a><\/noindex>.
\nSiin vaatame stabiilset versiooni Dockerfile'ist.<\/a><\/noindex>.<\/p>\n

# stable\/Dockerfile\n#\n# Build a Buildah container image from the latest\n# stable version of Buildah on the Fedoras Updates System.\n# https:\/\/bodhi.fedoraproject.org\/updates\/?search=buildah\n# This image can be used to create a secured container\n# that runs safely with privileges within the container.\n#\nFROM fedora:latest\n\n# Don't include container-selinux and remove\n# directories used by dnf that are just taking\n# up space.\nRUN yum -y install buildah fuse-overlayfs --exclude container-selinux; rm -rf \/var\/cache \/var\/log\/dnf* \/var\/log\/yum.*\n\n# Adjust storage.conf to enable Fuse storage.\nRUN sed -i -e 's|^#mount_program|mount_program|g' -e '\/additionalimage.*\/a \"\/var\/lib\/shared\",' \/etc\/containers\/storage.conf\n<\/code><\/pre>\n
\nOverlayFS asemel, mis on rakendatud hosti Linuxi tuuma tasemel, kasutame konteineris programmi fuse-overlay<\/a><\/noindex>, kuna praegu OverlayFS suudab monteerida, kui sellele antakse SYS_ADMIN \u00f5igused Linuxi v\u00f5imetega. Soovime oma Buildah konteinerid k\u00e4ivitada ilma root taseme \u00f5igusteta. Fuse-overlay t\u00f6\u00f6tab \u00fcsna kiiresti ja on j\u00f5udluse poolest parem kui VFS salvestusjuht. Pange t\u00e4hele, et Buildah konteiner, mis kasutab Fuse'i, vajab seadme \/dev\/fuse olemasolu.<\/p>\n
podman run --device \/dev\/fuse quay.io\/buildahctr ...\nRUN mkdir -p \/var\/lib\/shared\/overlay-images \/var\/lib\/shared\/overlay-layers; touch \/var\/lib\/shared\/overlay-images\/images.lock; touch \/var\/lib\/shared\/overlay-layers\/layers.lock\n<\/code><\/pre>\n
\nSeej\u00e4rel loome t\u00e4iendavate salvestuskohtade katalooge. Container\/storage<\/a><\/noindex> toetab t\u00e4iendavate ainult lugemiseks m\u00f5eldud piltide salvestuskohtade \u00fchendamise kontseptsiooni. N\u00e4iteks saab \u00fchel masinal seadistada overlay salvestusala ja seej\u00e4rel mountida see NFS'i abil teisele masinale ning kasutada seal olevaid pilte ilma pull'iga allalaadimata. See salvestuskoht on meil vajalik, et saaksime \u00fchendada m\u00f5ne pildi salvestuskoha hostilt ja kasutada seda konteineris.<\/p>\n
# Set up environment variables to note that this is\n# not starting with user namespace and default to\n# isolate the filesystem with chroot.\nENV _BUILDAH_STARTED_IN_USERNS=\"\" BUILDAH_ISOLATION=chroot\n<\/code><\/pre>\n
\nJa l\u00f5puks, kasutades keskkonnamuutujat BUILDAH_ISOLATION, \u00fctleme, et vaikimisi Buildah konteiner peaks k\u00e4ivituma chroot-isolatsiooniga. T\u00e4iendav isolatsioon pole vajalik, kuna t\u00f6\u00f6tame juba konteineris. Et Buildah saaks luua oma konteine eraldatud nimede ruumidega, on vajalik SYS_ADMIN privileeg, mis t\u00e4hendab, et tuleb n\u00f5rgendada konteineri SELinux ja SECCOMP reegleid, mis on vastuolus meie seadistusega, et teostada build'i turvalises konteineris.<\/p>\n
K\u00e4ivitame Buildah'i konteineris<\/h3>\n
\nEelpool arutatud Buildah konteineri pildi skeem v\u00f5imaldab paindlikult varieerida, kuidas selliseid konteinereid k\u00e4ivitada.<\/p>\n
Kiirus vastu turvalisus<\/h4>\n
\nArvutiturve on alati tasakaal kiirusprotsessi t\u00e4itmise ja selle \u00fcmber oleva kaitse vahel. See v\u00e4ide kehtib ka konteinerite koostamisel, seega vaatleme allpool sellise kompromissi v\u00f5imalusi.<\/p>\n
\u00dclaltoodud konteineripilt hoiab oma andmeid kataloogis \/var\/lib\/containers. Seet\u00f5ttu peame sisu selle kausta monteerima, ja see, kuidas me seda teeme, m\u00f5jutab oluliselt konteineripiltide koostamise kiirus.<\/p>\n
Vaatame kolme varianti.<\/p>\n
Variant 1.<\/b> Kui maksimaalne turvalisus on vajalik, saab iga konteineri jaoks luua oma kausta kataloogis containers\/image ja \u00fchendada selle konteineriga l\u00e4bi volume-mount. Lisaks sellele saab konteksti katalooge paigutada otse konteinerisse, kausta \/build:<\/p>\n
# mkdir \/var\/lib\/containers1\n# podman run -v .\/build:\/build:z -v \/var\/lib\/containers1:\/var\/lib\/containers:Z quay.io\/buildah\/stable\nbuildah  -t image1 bud \/build\n# podman run -v \/var\/lib\/containers1:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah  push  image1 registry.company.com\/myuser\n# rm -rf \/var\/lib\/containers1\n<\/code><\/pre>\n
\nTurvalisus.<\/i> Buildah konteiners t\u00f6\u00f6tab maksimaalse turvalisuse juures: sellele ei anta mingeid root-privileege capabilities'i kaudu, ja sellele kehtivad k\u00f5ik SECOMP ja SELinuxi piirangud. Sellist konteinerit saab isegi v\u00f5i isoleerida User Namespace'iga, lisades valiku nagu \u2014uidmap 0:100000:10000.<\/p>\n
T\u00f6\u00f6tlusv\u00f5imekus.<\/i> Siin on minimaalne j\u00f5udlus, kuna k\u00f5ik konteineriregistri pildid kopeeritakse iga kord hostile ja vahem\u00e4lu ei toimi mitte kuidagi. Oma t\u00f6\u00f6 l\u00f5petamisel peab Buildah-konteiner saatma pildi registrisse ja kustutama sisu hostist. J\u00e4rgmine kord, kui konteineri pilt kokkukogutakse, tuleb see uuesti registrist alla laadida, sest hostis ei j\u00e4\u00e4 sel ajal enam midagi alles.<\/p>\n
Variant 2.<\/b> Kui on vajalik Docker'i tasemel j\u00f5udlus, v\u00f5ib hosti container\/storage otse konteinerisse mountida.<\/p>\n
# podman run -v .\/build:\/build:z -v \/var\/lib\/containers:\/var\/lib\/containers --security-opt label:disabled quay.io\/buildah\/stable buildah  -t image2 bud \/build\n# podman run -v \/var\/lib\/containers:\/var\/lib\/containers --security-opt label:disabled  quay.io\/buildah\/stable buildah push image2 registry.company.com\/myuser\n<\/code><\/pre>\n
\nTurvalisus.<\/i> See on k\u00f5ige v\u00e4hem turvaline viis konteinerite koostamiseks, kuna sel juhul on konteinerile lubatud hosti salvestust muuta ja see v\u00f5ib potentsiaalselt sisestada Podmanile v\u00f5i CRI-O-le pahatahtliku pildi. Samuti tuleb v\u00e4lja l\u00fclitada SELinuxi isolatsioon, et Buildah-konteineris asuvad protsessid saaksid hosti salvestusega suhelda. Pange t\u00e4hele, et see variant on ikkagi parem kui Docker'i pistik, kuna konteinerit piiravad j\u00e4\u00e4nud turbefunktsioonid ja see ei saa lihtsalt v\u00f5tta ja k\u00e4ivitada mingit konteinerit hostis.<\/p>\n
T\u00f6\u00f6tlusv\u00f5imekus.<\/i> Siin on see maksimaalselt, kuna vahem\u00e4lu kasutatakse t\u00e4ielikult. Kui Podman v\u00f5i CRI-O on juba vajalikku imaget hostile alla laadinud, ei pea Buildah-protsess konteineri sees seda uuesti alla laadima ning sellele imagile tuginevad j\u00e4rgmised ehitused saavad samuti vajalikku v\u00f5tta vahem\u00e4lust.<\/p>\n
Variant 3.<\/b> Selle meetodi sisu on \u00fchendada mitu imaget \u00fchte projekti, millel on \u00fchine kaust konteinerite imagede jaoks.<\/p>\n
# mkdir \/var\/lib\/project3\n# podman run --security-opt label_level=s0:C100, C200 -v .\/build:\/build:z \n-v \/var\/lib\/project3:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah  -t image3 bud \/build\n# podman run --security-opt label_level=s0:C100, C200 \n-v \/var\/lib\/project3:\/var\/lib\/containers quay.io\/buildah\/stable buildah push image3  registry.company.com\/myuser\n<\/code><\/pre>\n
\nK\u00e4esolevas n\u00e4ites ei eemalda me projekti kausta (\/var\/lib\/project3) k\u00e4ivituste vahel, seet\u00f5ttu kasutavad k\u00f5ik j\u00e4rgmised ehitused projekti raames vahem\u00e4lu eeliseid.<\/p>\n
Turvalisus.<\/i> Midagi vahepealset variantide 1 ja 2 vahel. \u00dchelt poolt ei p\u00e4\u00e4se konteinerid hosti sisu juurde ja seega ei saa nad Podman\/CRI-O imagede hoidlasse midagi halba lisada. Teiselt poolt v\u00f5ib konteiner oma projekti raames sekkuda teiste konteinerite ehitamisse.<\/p>\n
T\u00f6\u00f6tlusv\u00f5imekus.<\/i> Siin on olukord halvem kui hosti tasemel \u00fcldise vahem\u00e4lu kasutamisel, kuna ei saa kasutada juba varem Podman\/CRI-O vahenditega allalaaditud pilte. Siiski, p\u00e4rast Buildah'i pilti allalaadimist saab seda kasutada k\u00f5igis hilisemates projektikogumites.<\/p>\n
Lisahoidlad<\/h4>\n
\nU containers\/storage<\/a><\/noindex> olemas on m\u00f5ningaid \u00e4gedaid asju nagu lisahoidlad (additional stores), mille abil saavad konteinerimootorid k\u00e4ivitus- ja kogumisprotsessi k\u00e4igus kasutada v\u00e4liseid pildihoidlaid read-only \u00fclekate re\u017eiimis. Sisuliselt saab faili storage.conf lisada \u00fche v\u00f5i mitu 'ainult lugemiseks' hoidlat, et seej\u00e4rel konteineri k\u00e4ivitamisel otsiks konteinerimootor vajalikku pilti neis. Samuti laeb see pildi registrist alla ainult siis, kui ei leia seda \u00fcheski nendest hoidlatest. Konstruktorimootor saab kirjutada ainult kirjutatavatesse hoidlatestesse...<\/p>\n
Kui kerida \u00fcles ja vaadata Dockerfile'i, mida me kasutame quay.io\/buildah\/stable pildi koostamiseks, siis seal on sellised read:<\/p>\n
# Adjust storage.conf to enable Fuse storage.\nRUN sed -i -e 's|^#mount_program|mount_program|g' -e '\/additionalimage.*\/a \"\/var\/lib\/shared\",' \/etc\/containers\/storage.conf\nRUN mkdir -p \/var\/lib\/shared\/overlay-images \/var\/lib\/shared\/overlay-layers; touch \/var\/lib\/shared\/overlay-images\/images.lock; touch \/var\/lib\/shared\/overlay-layers\/layers.lock\n<\/code><\/pre>\n
\nEsimeses reas muudame \/etc\/containers\/storage.conf konteineri pildi sees, \u00f6eldes salvestusdriverile, et kasutada \"additionalimagestores\" kaustas \/var\/lib\/shared. J\u00e4rgmises reas loome \u00fchise kausta ja lisame paar lukufaili, et v\u00e4ltida konflikte containers\/storage poolt. Sisuliselt loome lihtsalt t\u00fchja konteineripiltide salvestuse. <\/p>\n
Kui mountida containers\/storage selle kausta k\u00f5rgemale tasemele, suudab Buildah kasutada pilte.<\/p>\n
N\u00fc\u00fcd naaseme eelpool k\u00e4sitletud variandi 2 juurde, kus Buildah-konteiner suudab lugeda ja kirjutada containers\/store hostides, omades seega maksimaalset j\u00f5udlust pilte vahem\u00e4llu salvestades Podman\/CRI-O tasemel, kuid pakkudes minimaalset turvalisust, kuna v\u00f5ib kirjutada otse salvestustesse. N\u00fc\u00fcd lisame siia t\u00e4iendavad salvestused ja saame kahest maailmast parima.<\/p>\n
# mkdir \/var\/lib\/containers4\n# podman run -v .\/build:\/build:z -v \/var\/lib\/containers\/storage:\/var\/lib\/shared:ro -v  \/var\/lib\/containers4:\/var\/lib\/containers:Z  quay.io\/buildah\/stable \n buildah  -t image4 bud \/build\n# podman run -v \/var\/lib\/containers\/storage:\/var\/lib\/shared:ro  \n-v >\/var\/lib\/containers4:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah push image4  registry.company.com\/myuser\n# rm -rf \/var\/lib\/continers4\n<\/code><\/pre>\n
\nP\u00f6\u00f6rake t\u00e4helepanu, et hosti \/var\/lib\/containers\/storage on monteeritud konteineris \/var\/lib\/shared ainult lugemisre\u017eiimis. Seet\u00f5ttu v\u00f5ib Buildah konteineris t\u00f6\u00f6tades kasutada k\u00f5iki varasemaid Podman\/CRI-O vahendeid allalaaditud pilte (tervitused kiirusest), kuid kirjutada saab ainult oma salvestusse (tervitused turvalisusele). Samuti p\u00f6\u00f6rake t\u00e4helepanu, et see toimub ilma SELinuxi eraldamise keelamiseta konteineri jaoks.<\/p>\n
Oluline n\u00fcanss<\/h4>\n
\nIgal juhul ei ole lubatud alumisest salvestusest pilte kustutada. Vastasel korral v\u00f5ib Buildah konteiner kokku kukkuda.<\/p>\n
Ja see ei ole kaugeltki k\u00f5ik eelised<\/h4>\n
\nLisaandmete salvestamise v\u00f5imalused ei piirdu ainult eespool kirjeldatud stsenaariumiga. N\u00e4iteks v\u00f5ib k\u00f5iki konteineripilte hoida \u00fchises v\u00f5rgus ja anda sellele ligip\u00e4\u00e4su k\u00f5igile Buildah konteineritele. Oletame, et meil on sadu pilte, mida meie CI\/CD s\u00fcsteem regulaarselt kasutab konteineripiltide koostamiseks. Koondame k\u00f5ik need pildid \u00fchele hosti-salvestusse ja seej\u00e4rel, kasutades eelistatud v\u00f5rgu salvestusv\u00f5imalusi (NFS, Gluster, Ceph, ISCSI, S3\u2026), avame sellele salvestusele juurdep\u00e4\u00e4su k\u00f5ikidele Buildah v\u00f5i Kubernetes node\u2019idele.<\/p>\n
N\u00fc\u00fcd piisab, kui see v\u00f5rgu salvestus mountida Buildah konteinerisse kausta \/var\/lib\/shared ja k\u00f5ik \u2013 Buildah konteeritel ei ole enam vaja pilte pullida. Nii viskame eelmise t\u00e4itmisfaasi (pre-population) v\u00e4lja ja oleme kohe valmis konteinerite k\u00e4ivitamiseks.<\/p>\n
Ja muidugi saab seda kasutada olemasolevas Kubernetes-s\u00fcsteemis v\u00f5i konteinerite infrastruktuuris, et k\u00e4ivitada ja t\u00f6\u00f6delda konteineriteid igal pool ilma mingite piltide allalaadimist pull-iga. Veelgi enam, konteineriregister, saades push-p\u00e4ringu uuendatud pildi \u00fcleslaadimiseks, saab automaatselt saata selle pildi \u00fcldisesse v\u00f5rguhoidlasse, kus see muutub k\u00f5ikidele s\u00f5lmedele koheselt k\u00e4ttesaadavaks.<\/p>\n
Konteinerite piltide suurused v\u00f5ivad m\u00f5nikord ulatuda mitme gigabaidini. T\u00e4iendavate ladustamisv\u00f5imaluste funktsionaalsus v\u00f5imaldab v\u00e4ltida selliste piltide kopeerimist s\u00f5lmedesse ning muudab konteinerite k\u00e4ivitamise praktiliselt hetkega.<\/p>\n
Lisaks t\u00f6\u00f6tame hetkel uue overlay volume mounts funktsiooni kallal, mis teeb konteinerite koostamise veelgi kiiremaks.<\/p>\n
Kokkuv\u00f5te<\/h3>\n
\nBuildah'i k\u00e4itamine konteineris Kubernetes'e\/CRI-O, Podmani v\u00f5i isegi Docker'i keskkonnas on t\u00e4iesti reaalne, lisaks on see lihtsam ja oluliselt turvalisem kui docker.socket'i kasutamine. Oleme oluliselt suurendanud t\u00f6\u00f6tamise paindlikkust piltidega ning n\u00fc\u00fcd saate neid k\u00e4ivitada erinevatel viisidel, et saavutada optimaalne tasakaal turvalisuse ja j\u00f5udluse vahel.<\/p>\n
Lisa salvestusfunktsioon kiirendab v\u00f5i v\u00e4hendab isegi t\u00e4ielikult piltide allalaadimist s\u00f5lmedesse.
\n
Allikas: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0447\u0435\u043c \u043f\u0440\u0435\u043b\u0435\u0441\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435? \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043a\u043e\u043c\u0431\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043e\u043d\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u043b\u0438 \u0434\u0440\u0443\u0433 \u0434\u0440\u0443\u0433\u0430. \u041c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0438\u0434\u0435\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0441\u0431\u043e\u0440\u043a\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 OCI-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Kubernetes \u0438\u043b\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0414\u043e\u043f\u0443\u0441\u0442\u0438\u043c, \u0443 \u043d\u0430\u0441 \u0435\u0441\u0442\u044c CI\/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b, \u0442\u043e\u0433\u0434\u0430 \u0447\u0442\u043e-\u0442\u043e \u0442\u0438\u043f\u0430 Red Hat OpenShift\/Kubernetes \u0431\u044b\u043b\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38785","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Soovitused Buildah'i k\u00e4ivitamiseks konteineris | ProHoster","description":"Mis on konteinerite t\u00f6\u00f6tamise keskkonna jagamise ilu eraldi t\u00f6\u00f6riistakomponentide vahel? Eriti see, et neid t\u00f6\u00f6riistu saab hakata omavahel kombineerima, et nad \u00fcksteist kaitseksid. Paljusid t\u00f5mbab idee ehitada konteinerite OCI-pilte Kuberneteses v\u00f5i sarnases s\u00fcsteemis. Oletame, et meil on CI\/CD, mis pidevalt kogub pilte, siis midagi nagu Red Hat OpenShift\/Kubernetes oleks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0443 Buildah \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u0447\u0435\u043c \u043f\u0440\u0435\u043b\u0435\u0441\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435? \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043a\u043e\u043c\u0431\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043e\u043d\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u043b\u0438 \u0434\u0440\u0443\u0433 \u0434\u0440\u0443\u0433\u0430. \u041c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0438\u0434\u0435\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0441\u0431\u043e\u0440\u043a\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 OCI-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Kubernetes \u0438\u043b\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0414\u043e\u043f\u0443\u0441\u0442\u0438\u043c, \u0443 \u043d\u0430\u0441 \u0435\u0441\u0442\u044c CI\/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b, \u0442\u043e\u0433\u0434\u0430 \u0447\u0442\u043e-\u0442\u043e \u0442\u0438\u043f\u0430 Red Hat OpenShift\/Kubernetes \u0431\u044b\u043b\u043e","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:25:55+00:00","article:modified_time":"2019-10-31T19:25:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38785","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:03:14","updated":"2026-01-23 23:24:21"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=38785"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/38785\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/29093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=38785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=38785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=38785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}