{"id":38785,"date":"2019-10-31T22:25:55","date_gmt":"2019-10-31T19:25:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera\/"},"modified":"2019-10-31T22:25:55","modified_gmt":"2019-10-31T19:25:55","slug":"rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","title":{"rendered":"Odpor\u00fa\u010dania na spustenie Buildah vo vn\u00fatri kontajnera","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ak\u00e1 je v\u00fdhoda rozdelenia prostredia vykon\u00e1vania kontajnerov na jednotliv\u00e9 n\u00e1stroje? Predov\u0161etk\u00fdm to, \u017ee tieto n\u00e1stroje m\u00f4\u017eeme za\u010da\u0165 kombinova\u0165, aby sa navz\u00e1jom chr\u00e1nili.<\/p>\n

\"Odpor\u00fa\u010dania
\n
\nMnoh\u00fdch l\u00e1ka my\u0161lienka vykon\u00e1va\u0165 zostavovanie kontajnerov\u00fdch OCI obrazov v r\u00e1mci Kubernetes<\/a><\/noindex> alebo podobn\u00e9ho syst\u00e9mu. Predpokladajme, \u017ee m\u00e1me CI\/CD, ktor\u00e9 neust\u00e1le zostavuje obrazy, potom nie\u010do ako Red Hat OpenShift<\/a><\/noindex>\/Kubernetes \u0431\u044b\u043b\u043e \u0431\u044b \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435. \u0414\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u043f\u043e\u0440 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043b\u044e\u0434\u0435\u0439 \u043f\u0440\u043e\u0441\u0442\u043e \u0434\u0430\u0432\u0430\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a Docker-\u0441\u043e\u043a\u0435\u0442\u0443 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 docker build. U\u017e pred nieko\u013ek\u00fdmi rokmi sme uk\u00e1zali<\/a><\/noindex>, \u017ee je to ve\u013emi nebezpe\u010dn\u00e9, v skuto\u010dnosti je to dokonca hor\u0161ie, ako da\u0165 bezheslov\u00fd root alebo sudo.
\n<\/a><\/noindex>
\nPreto sa \u013eudia neust\u00e1le sna\u017eia sp\u00fa\u0161\u0165a\u0165 Buildah v kontajneri. Skr\u00e1tka, vytvorili sme pr\u00edklad<\/a><\/noindex> to, ako, pod\u013ea n\u00e1\u0161ho n\u00e1zoru, najlep\u0161ie sp\u00fa\u0161\u0165a\u0165 Buildah vo vn\u00fatri kontajnera, a zverejnili sme pr\u00edslu\u0161n\u00e9 obrazy na quay.io\/buildah<\/a><\/noindex>. Po\u010fme na to\u2026<\/p>\n

Nastavenie<\/h3>\n

\nTieto obrazy s\u00fa zostaven\u00e9 z Dockerfiles, ktor\u00e9 n\u00e1jdete v repozit\u00e1ri Buildah v prie\u010dinku buildahimage<\/a><\/noindex>.
\nTu sa pozrieme na stabiln\u00fa verziu Dockerfile<\/a><\/noindex>.<\/p>\n

# stable\/Dockerfile\n#\n# Build a Buildah container image from the latest\n# stable version of Buildah on the Fedoras Updates System.\n# https:\/\/bodhi.fedoraproject.org\/updates\/?search=buildah\n# This image can be used to create a secured container\n# that runs safely with privileges within the container.\n#\nFROM fedora:latest\n\n# Don't include container-selinux and remove\n# directories used by dnf that are just taking\n# up space.\nRUN yum -y install buildah fuse-overlayfs --exclude container-selinux; rm -rf \/var\/cache \/var\/log\/dnf* \/var\/log\/yum.*\n\n# Adjust storage.conf to enable Fuse storage.\nRUN sed -i -e 's|^#mount_program|mount_program|g' -e '\/additionalimage.*\/a \"\/var\/lib\/shared\",' \/etc\/containers\/storage.conf\n<\/code><\/pre>\n
\nNamiesto OverlayFS, implementovanej na \u00farovni Linuxov\u00e9ho jadra hostite\u013ea, pou\u017e\u00edvame vo vn\u00fatri kontajnera program fuse-overlay<\/a><\/noindex>, preto\u017ee v s\u00fa\u010dasnosti m\u00f4\u017ee OverlayFS vykon\u00e1va\u0165 montovanie, len ak jej poskytneme opr\u00e1vnenia SYS_ADMIN prostriedkami Linux capabilities. A chceme sp\u00fa\u0161\u0165a\u0165 na\u0161e Buildah kontajnery bez ak\u00fdchko\u013evek root opr\u00e1vnen\u00ed. Fuse-overlay pracuje dos\u0165 r\u00fdchlo a po v\u00fdkonnostnej str\u00e1nke je lep\u0161ie ako storage ovl\u00e1da\u010d VFS. Upozor\u0148ujeme, \u017ee pri sp\u00fa\u0161\u0165an\u00ed Buildah kontajnera, ktor\u00fd pou\u017e\u00edva Fuse, je potrebn\u00e9 poskytn\u00fa\u0165 zariadenie \/dev\/fuse.<\/p>\n
podman run --device \/dev\/fuse quay.io\/buildahctr ...\nRUN mkdir -p \/var\/lib\/shared\/overlay-images \/var\/lib\/shared\/overlay-layers; touch \/var\/lib\/shared\/overlay-images\/images.lock; touch \/var\/lib\/shared\/overlay-layers\/layers.lock\n<\/code><\/pre>\n
\n\u010ealej vytvor\u00edme adres\u00e1r pre \u010fal\u0161ie \u00falo\u017eisk\u00e1. Container\/storage<\/a><\/noindex> podporuje koncept pripojenia \u010fal\u0161\u00edch read-only \u00falo\u017e\u00edsk obrazov. Napr\u00edklad, m\u00f4\u017eeme nakonfigurova\u0165 overlay storage area na jednom po\u010d\u00edta\u010di a potom to \u00falo\u017eisko pripoji\u0165 pomocou NFS na inom po\u010d\u00edta\u010di a pou\u017e\u00edva\u0165 obrazy z neho bez s\u0165ahovania cez pull. Toto \u00falo\u017eisko potrebujeme na to, aby sme mohli pripoji\u0165 ako zv\u00e4zok nejak\u00e9 \u00falo\u017eisko obrazov z hostite\u013ea a pou\u017ei\u0165 ho vo vn\u00fatri kontajnera.<\/p>\n
# Set up environment variables to note that this is\n# not starting with user namespace and default to\n# isolate the filesystem with chroot.\nENV _BUILDAH_STARTED_IN_USERNS=\"\" BUILDAH_ISOLATION=chroot\n<\/code><\/pre>\n
\nA nakoniec, pomocou premennej prostredia BUILDAH_ISOLATION hovor\u00edme, \u017ee predvolene by sa kontajner Buildah mal sp\u00fa\u0161\u0165a\u0165 s izol\u00e1ciou chroot. Dodato\u010dn\u00e1 izol\u00e1cia nie je potrebn\u00e1, preto\u017ee u\u017e pracujeme v kontajneri. Na to, aby Buildah vytv\u00e1ral svoje vlastn\u00e9 kontajnery s oddelen\u00edm priestorov mien, je potrebn\u00e1 pr\u00e1vo SYS_ADMIN, a na to bude potrebn\u00e9 oslabi\u0165 pravidl\u00e1 SELinux a SECCOMP pre kontajner, \u010do je v rozpore s na\u0161ou in\u0161tal\u00e1ciou na vykon\u00e1vanie zostaven\u00ed v bezpe\u010dnom kontajneri.<\/p>\n
Sp\u00fa\u0161\u0165ame Buildah vo vn\u00fatri kontajnera<\/h3>\n
\nPrediskutovan\u00fd obraz kontajnera Buildah umo\u017e\u0148uje flexibilne variabiln\u00e9 sp\u00f4soby sp\u00fa\u0161\u0165ania tak\u00fdchto kontajnerov.<\/p>\n
R\u00fdchlos\u0165 vs. bezpe\u010dnos\u0165<\/h4>\n
\nPo\u010d\u00edta\u010dov\u00e1 bezpe\u010dnos\u0165 je v\u017edy kompromisom medzi r\u00fdchlos\u0165ou vykon\u00e1vania procesu a mno\u017estvom ochrany, ktor\u00e1 je okolo toho. Toto tvrdenie plat\u00ed aj pri zostavovan\u00ed kontajnerov, preto sa ni\u017e\u0161ie pozrieme na mo\u017enosti tak\u00e9ho kompromisu.<\/p>\n
Prediskutovan\u00fd obraz kontajnera bude uchov\u00e1va\u0165 svoje \u00falo\u017eisko v \/var\/lib\/containers. Preto mus\u00edme pripoji\u0165 obsah do tejto zlo\u017eky, a to, ako to sprav\u00edme, bude ma\u0165 ve\u013ek\u00fd vplyv na r\u00fdchlos\u0165 zostavovania obrazov kontajnerov.<\/p>\n
Presk\u00famajme tri mo\u017enosti.<\/p>\n
Mo\u017enos\u0165 1.<\/b> Ak je potrebn\u00e1 maxim\u00e1lna bezpe\u010dnos\u0165, pre ka\u017ed\u00fd kontajner je mo\u017en\u00e9 vytvori\u0165 svoju vlastn\u00fa zlo\u017eku pre containers\/image a pripoji\u0165 ju ku kontajneru pomocou volume-mount. Okrem toho, m\u00f4\u017eeme umiestni\u0165 kontextov\u00fa zlo\u017eku priamo do kontajnera, do zlo\u017eky \/build:<\/p>\n
# mkdir \/var\/lib\/containers1\n# podman run -v .\/build:\/build:z -v \/var\/lib\/containers1:\/var\/lib\/containers:Z quay.io\/buildah\/stable\nbuildah  -t image1 bud \/build\n# podman run -v \/var\/lib\/containers1:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah  push  image1 registry.company.com\/myuser\n# rm -rf \/var\/lib\/containers1\n<\/code><\/pre>\n
\nBezpe\u010dnos\u0165.<\/i> Pr\u00e1ca v takomto kontejnere Buildah zais\u0165uje maxim\u00e1lnu bezpe\u010dnos\u0165: nedost\u00e1va \u017eiadne root privil\u00e9gi\u00e1 prostriedkami capabilities a s\u00fa na\u0148 aplikovan\u00e9 v\u0161etky obmedzenia SECOMP a SELinux. Tak\u00fdto kontajner je mo\u017en\u00e9 dokonca sp\u00fa\u0161\u0165a\u0165 s izol\u00e1ciou User Namespace, pridan\u00edm vo\u013eby ako je \u2014uidmap 0:100000:10000.<\/p>\n
V\u00fdkon.<\/i> Tu je v\u0161ak v\u00fdkon minim\u00e1lny, preto\u017ee ak\u00e9ko\u013evek obrazy z kontajnerov\u00fdch registrat\u00farov sa zaka\u017ed\u00fdm kop\u00edruj\u00fa na hostite\u013ea a cacheovanie nefunguje od slova \u201eni\u010d\u201c. Na konci svojej pr\u00e1ce mus\u00ed kontajner Buildah posla\u0165 obraz do registru a zni\u010di\u0165 obsah na hostite\u013eovi. Ke\u010f sa kontajnerov\u00fd obraz bude bud\u00faci raz zostavova\u0165, bude ho potrebn\u00e9 znovu stiahnu\u0165 z registra, preto\u017ee na hostite\u013eovi u\u017e v tom \u010dase ni\u010d neostane.<\/p>\n
Mo\u017enos\u0165 2.<\/b> Ak potrebujete v\u00fdkon na \u00farovni Dockeru, m\u00f4\u017eete pripoji\u0165 container\/storage hosta priamo do kontajnera.<\/p>\n
# podman run -v .\/build:\/build:z -v \/var\/lib\/containers:\/var\/lib\/containers --security-opt label:disabled quay.io\/buildah\/stable buildah  -t image2 bud \/build\n# podman run -v \/var\/lib\/containers:\/var\/lib\/containers --security-opt label:disabled  quay.io\/buildah\/stable buildah push image2 registry.company.com\/myuser\n<\/code><\/pre>\n
\nBezpe\u010dnos\u0165.<\/i> Toto je najmenej bezpe\u010dn\u00fd sp\u00f4sob zostavovania kontajnerov, preto\u017ee kontajner m\u00e1 povolen\u00e9 upravova\u0165 \u00falo\u017eisko na hoste a potenci\u00e1lne m\u00f4\u017ee prenikn\u00fa\u0165 do Podmanu alebo CRI-O s nebezpe\u010dn\u00fdm obrazom. Okrem toho bude potrebn\u00e9 vypn\u00fa\u0165 oddelenie SELinux, aby procesy vo vn\u00fatri kontajnera Buildah mohli interagova\u0165 s \u00falo\u017eiskom na hoste. V\u0161imnite si, \u017ee t\u00e1to mo\u017enos\u0165 je predsa len lep\u0161ia ako Docker socket, preto\u017ee kontajner je chr\u00e1nen\u00fd zvy\u0161n\u00fdmi bezpe\u010dnostn\u00fdmi funkciami a nem\u00f4\u017ee len tak vzia\u0165 a spusti\u0165 nejak\u00fd kontajner na hoste.<\/p>\n
V\u00fdkon.<\/i> Tu je maxim\u00e1lna, preto\u017ee sa \u00faplne vyu\u017e\u00edva cache. Ak u\u017e Podman alebo CRI-O stihli stiahnu\u0165 potrebn\u00fd obraz na host, proces Buildah vo vn\u00fatri kontajnera ho nebude musie\u0165 s\u0165ahova\u0165 znova a n\u00e1sledn\u00e9 zostavovania na z\u00e1klade tohto obrazu ho tie\u017e bud\u00fa m\u00f4c\u0165 z\u00edska\u0165 z cache.<\/p>\n
Mo\u017enos\u0165 3.<\/b> Podstatou tohto sp\u00f4sobu je spoji\u0165 nieko\u013eko obrazov do jedn\u00e9ho projektu so spolo\u010dn\u00fdm prie\u010dinkom pre kontajnerov\u00e9 obrazy.<\/p>\n
# mkdir \/var\/lib\/project3\n# podman run --security-opt label_level=s0:C100, C200 -v .\/build:\/build:z \n-v \/var\/lib\/project3:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah  -t image3 bud \/build\n# podman run --security-opt label_level=s0:C100, C200 \n-v \/var\/lib\/project3:\/var\/lib\/containers quay.io\/buildah\/stable buildah push image3  registry.company.com\/myuser\n<\/code><\/pre>\n
\nV tomto pr\u00edklade nezmizne prie\u010dinok projektu (\/var\/lib\/project3) medzi spusteniami, tak\u017ee v\u0161etky \u010fal\u0161ie zostavenia v r\u00e1mci projektu vyu\u017e\u00edvaj\u00fa v\u00fdhody cachovania.<\/p>\n
Bezpe\u010dnos\u0165.<\/i> Nie\u010do medzi mo\u017enos\u0165ami 1 a 2. Na jednej strane kontajnery nemaj\u00fa pr\u00edstup k obsahu na hoste a teda nem\u00f4\u017eu prenikn\u00fa\u0165 do \u00falo\u017eiska obrazov Podman\/CRI-O. Na druhej strane m\u00f4\u017ee kontajner vo svojom projekte zasahova\u0165 do zostavovania in\u00fdch kontajnerov.<\/p>\n
V\u00fdkon.<\/i> Tu je to hor\u0161ie ako pri pou\u017e\u00edvan\u00ed spolo\u010dnej cache na \u00farovni hosta, preto\u017ee nie je mo\u017en\u00e9 pou\u017ei\u0165 obrazy, ktor\u00e9 u\u017e boli predt\u00fdm stiahnut\u00e9 pomocou Podman\/CRI-O. Av\u0161ak po tom, ako Buildah stiahne obraz, tento obraz je mo\u017en\u00e9 pou\u017ei\u0165 v ak\u00fdchko\u013evek nasleduj\u00facich zostaveniach v r\u00e1mci projektu.<\/p>\n
\u010eal\u0161ie \u00falo\u017eisk\u00e1<\/h4>\n
\nU containers\/storage<\/a><\/noindex> Existuje skv\u011bl\u00e1 funkce jako dodate\u010dn\u00e9 \u00falo\u017ei\u0161t\u011b (additional stores), d\u00edky kter\u00e9 mohou kontejnerov\u00e9 motory p\u0159i spu\u0161t\u011bn\u00ed a sestavov\u00e1n\u00ed kontejner\u016f pou\u017e\u00edvat extern\u00ed \u00falo\u017ei\u0161t\u011b obraz\u016f v re\u017eimu pouze pro \u010dten\u00ed overlay. V podstat\u011b je mo\u017en\u00e9 do souboru storage.conf p\u0159idat jedno nebo v\u00edce \u201epouze pro \u010dten\u00ed\u201c \u00falo\u017ei\u0161\u0165, aby kontejnerov\u00fd motor p\u0159i spu\u0161t\u011bn\u00ed kontejneru hledal pot\u0159ebn\u00fd obraz v nich. St\u00e1hne obraz z registru pouze v p\u0159\u00edpad\u011b, \u017ee jej nenajde v \u017e\u00e1dn\u00e9m z t\u011bchto \u00falo\u017ei\u0161\u0165. Kontejnerov\u00fd motor bude moci zapisovat pouze do \u00falo\u017ei\u0161\u0165, kter\u00e1 jsou dostupn\u00e1 pro z\u00e1pis...<\/p>\n
Pokud se posuneme nahoru a pod\u00edv\u00e1me se na Dockerfile, kter\u00fd pou\u017e\u00edv\u00e1me pro sestaven\u00ed obrazu quay.io\/buildah\/stable, najdeme tam tyto \u0159\u00e1dky:<\/p>\n
# Adjust storage.conf to enable Fuse storage.\nRUN sed -i -e 's|^#mount_program|mount_program|g' -e '\/additionalimage.*\/a \"\/var\/lib\/shared\",' \/etc\/containers\/storage.conf\nRUN mkdir -p \/var\/lib\/shared\/overlay-images \/var\/lib\/shared\/overlay-layers; touch \/var\/lib\/shared\/overlay-images\/images.lock; touch \/var\/lib\/shared\/overlay-layers\/layers.lock\n<\/code><\/pre>\n
\nV prvn\u00edm \u0159\u00e1dku modifikujeme \/etc\/containers\/storage.conf uvnit\u0159 kontejnerov\u00e9ho obrazu, \u0159\u00edk\u00e1me storage-drivers, aby pou\u017eil \u201eadditionalimagestores\u201c v adres\u00e1\u0159i \/var\/lib\/shared. V n\u00e1sleduj\u00edc\u00edm \u0159\u00e1dku vytv\u00e1\u0159\u00edme sd\u00edlenou slo\u017eku a p\u0159id\u00e1v\u00e1me n\u011bkolik z\u00e1mkov\u00fdch soubor\u016f, aby nedoch\u00e1zelo k probl\u00e9m\u016fm ze strany containers\/storage. V podstat\u011b vytv\u00e1\u0159\u00edme pr\u00e1zdn\u00e9 \u00falo\u017ei\u0161t\u011b kontejnerov\u00fdch obraz\u016f. <\/p>\n
Pokud p\u0159ipoj\u00edme containers\/storage o \u00farove\u0148 v\u00fd\u0161 ne\u017e tato slo\u017eka, Buildah bude moci pou\u017e\u00edvat obrazy.<\/p>\n
Nyn\u00ed se vra\u0165me k Variantu 2, kdy m\u016f\u017ee Buildah-kontejner \u010d\u00edst a zapisovat do containers\/store na hostitel\u00edch a m\u00e1 tak maxim\u00e1ln\u00ed v\u00fdkon d\u00edky ukl\u00e1d\u00e1n\u00ed obraz\u016f na \u00farovni Podman\/CRI-O, ale poskytuje minim\u00e1ln\u00ed bezpe\u010dnost, proto\u017ee m\u016f\u017ee zapisovat p\u0159\u00edmo do \u00falo\u017ei\u0161\u0165. A nyn\u00ed p\u0159id\u00e1me dodate\u010dn\u00e1 \u00falo\u017ei\u0161t\u011b a z\u00edsk\u00e1me to nejlep\u0161\u00ed z obou sv\u011bt\u016f.<\/p>\n
# mkdir \/var\/lib\/containers4\n# podman run -v .\/build:\/build:z -v \/var\/lib\/containers\/storage:\/var\/lib\/shared:ro -v  \/var\/lib\/containers4:\/var\/lib\/containers:Z  quay.io\/buildah\/stable \n buildah  -t image4 bud \/build\n# podman run -v \/var\/lib\/containers\/storage:\/var\/lib\/shared:ro  \n-v >\/var\/lib\/containers4:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah push image4  registry.company.com\/myuser\n# rm -rf \/var\/lib\/continers4\n<\/code><\/pre>\n
\nV\u0161imn\u011bte si, \u017ee \/var\/lib\/containers\/storage hostitele je p\u0159ipojena do \/var\/lib\/shared uvnit\u0159 kontejneru v re\u017eimu pouze pro \u010dten\u00ed. Proto m\u016f\u017ee Buildah p\u0159i pr\u00e1ci v kontejneru pou\u017e\u00edvat jak\u00e9koli obrazy, kter\u00e9 byly d\u0159\u00edve sta\u017eeny pomoc\u00ed Podman\/CRI-O (ahoj, rychlost), ale zapisovat m\u016f\u017ee pouze do sv\u00e9ho vlastn\u00edho \u00falo\u017ei\u0161t\u011b (ahoj, bezpe\u010dnost). Tak\u00e9 si dejte pozor, \u017ee to je provedeno bez vypnut\u00ed odd\u011blen\u00ed SELinux pro kontejner.<\/p>\n
D\u016fle\u017eit\u00e1 pozn\u00e1mka<\/h4>\n
\nV \u017e\u00e1dn\u00e9m p\u0159\u00edpad\u011b by se nem\u011bly mazat \u017e\u00e1dn\u00e9 obrazy z podkladov\u00e9ho \u00falo\u017ei\u0161t\u011b. Jinak m\u016f\u017ee Buildah-kontejner vylet\u011bt.<\/p>\n
A to rozhodn\u011b nejsou v\u0161echny v\u00fdhody<\/h4>\n
\nMo\u017enosti dodato\u010dn\u00fdch \u00falo\u017e\u00edsk nie s\u00fa obmedzen\u00e9 len na vy\u0161\u0161ie op\u00edsan\u00fd scen\u00e1r. Napr\u00edklad, v\u0161etky kontajnerov\u00e9 obrazy m\u00f4\u017eu by\u0165 ulo\u017een\u00e9 v spolo\u010dnom sie\u0165ovom \u00falo\u017eisku a poskytnut\u00fd pr\u00edstup v\u0161etk\u00fdm kontajnerom Buildah. Predpokladajme, \u017ee m\u00e1me stovky obrazov, ktor\u00e9 na\u0161a CI\/CD syst\u00e9m pravidelne pou\u017e\u00edva na vytv\u00e1ranie kontajnerov\u00fdch obrazov. S\u00fastred\u00edme v\u0161etky tieto obrazy na nejakom jednom hostite\u013eskom \u00falo\u017eisku a potom, pomocou preferovan\u00fdch prostriedkov sie\u0165ov\u00e9ho \u00falo\u017eiska (NFS, Gluster, Ceph, ISCSI, S3\u2026), otvor\u00edme spolo\u010dn\u00fd pr\u00edstup k tomuto \u00falo\u017eisku v\u0161etk\u00fdm nodom Buildah alebo Kubernetes.<\/p>\n
Teraz sta\u010d\u00ed podmontova\u0165 toto sie\u0165ov\u00e9 \u00falo\u017eisko do kontajnera Buildah na \/var\/lib\/shared a to je v\u0161etko \u2013 kontajnerom Buildah u\u017e v\u00f4bec nebude potrebn\u00e9 s\u0165ahova\u0165 obrazy cez pull. T\u00fdmto sp\u00f4sobom eliminujeme f\u00e1zu predbe\u017en\u00e9ho naplnenia (pre-population) a okam\u017eite sme pripraven\u00ed nasadzova\u0165 kontajnery.<\/p>\n
A samozrejme, to mo\u017eno vyu\u017ei\u0165 v r\u00e1mci existuj\u00faceho syst\u00e9mu Kubernetes alebo kontajnerovej infra\u0161trukt\u00fary, aby sa kontajnery sp\u00fa\u0161\u0165ali a vykon\u00e1vali kdeko\u013evek bez ak\u00e9hokoliv s\u0165ahovania obrazov cez pull. Navy\u0161e, registrovan\u00fd kontajner, ktor\u00fd prij\u00edma push-request na nahranie aktualizovan\u00e9ho obrazu, m\u00f4\u017ee automaticky odosla\u0165 tento obraz do spolo\u010dn\u00e9ho sie\u0165ov\u00e9ho \u00falo\u017eiska, kde sa okam\u017eite st\u00e1va dostupn\u00fdm v\u0161etk\u00fdm nodom.<\/p>\n
Ve\u013ekosti kontajnerov\u00fdch obrazov m\u00f4\u017eu niekedy dosahova\u0165 nieko\u013eko gigabajtov. Funkcionalita dodato\u010dn\u00fdch \u00falo\u017e\u00edsk umo\u017e\u0148uje vyhn\u00fa\u0165 sa klonovaniu t\u00fdchto obrazov po nod\u00e1ch a rob\u00ed sp\u00fa\u0161\u0165anie kontajnerov takmer okam\u017eit\u00fdm.<\/p>\n
Okrem toho v s\u00fa\u010dasnosti pracujeme na novej funkcii overlay volume mounts, ktor\u00e1 urob\u00ed vytv\u00e1ranie kontajnerov e\u0161te r\u00fdchlej\u0161\u00edm.<\/p>\n
Z\u00e1ver<\/h3>\n
\nVykon\u00e1va\u0165 Buildah vo vn\u00fatri kontajnera v prostred\u00ed Kubernetes\/CRI-O, Podman alebo dokonca v Dockeri je celkom re\u00e1lne, navy\u0161e je to jednoduch\u0161ie a ove\u013ea bezpe\u010dnej\u0161ie, ne\u017e pou\u017e\u00edva\u0165 docker.socket. V\u00fdrazne sme zv\u00fd\u0161ili flexibilitu pr\u00e1ce s obrazmi a teraz ich m\u00f4\u017eete sp\u00fa\u0161\u0165a\u0165 r\u00f4znymi sp\u00f4sobmi pre optim\u00e1lnu rovnov\u00e1hu medzi bezpe\u010dnos\u0165ou a v\u00fdkonom.<\/p>\n
Funkcionalita dodato\u010dn\u00fdch \u00falo\u017e\u00edsk umo\u017e\u0148uje ur\u00fdchli\u0165 alebo dokonca \u00faplne eliminova\u0165 s\u0165ahovanie obrazov na nody.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0447\u0435\u043c \u043f\u0440\u0435\u043b\u0435\u0441\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435? \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043a\u043e\u043c\u0431\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043e\u043d\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u043b\u0438 \u0434\u0440\u0443\u0433 \u0434\u0440\u0443\u0433\u0430. \u041c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0438\u0434\u0435\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0441\u0431\u043e\u0440\u043a\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 OCI-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Kubernetes \u0438\u043b\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0414\u043e\u043f\u0443\u0441\u0442\u0438\u043c, \u0443 \u043d\u0430\u0441 \u0435\u0441\u0442\u044c CI\/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b, \u0442\u043e\u0433\u0434\u0430 \u0447\u0442\u043e-\u0442\u043e \u0442\u0438\u043f\u0430 Red Hat OpenShift\/Kubernetes \u0431\u044b\u043b\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38785","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Odpor\u00fa\u010dania na sp\u00fa\u0161\u0165anie Buildah vo vn\u00fatri kontajnera | ProHoster","description":"V \u010dom spo\u010d\u00edva v\u00fdhoda rozdelenia prostredia na jednotliv\u00e9 n\u00e1stroje?","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0443 Buildah \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u0447\u0435\u043c \u043f\u0440\u0435\u043b\u0435\u0441\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435?","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:25:55+00:00","article:modified_time":"2019-10-31T19:25:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38785","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:03:14","updated":"2026-01-23 23:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/38785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=38785"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/38785\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/29093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=38785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=38785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=38785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}