{"id":38785,"date":"2019-10-31T22:25:55","date_gmt":"2019-10-31T19:25:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera\/"},"modified":"2019-10-31T22:25:55","modified_gmt":"2019-10-31T19:25:55","slug":"rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","title":{"rendered":"Rekomandime p\u00ebr ekzekutimin e Buildah brenda nj\u00eb kontejneri","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00c7far\u00eb \u00ebsht\u00eb e ve\u00e7anta n\u00eb ndarjen e mjedisit t\u00eb ekzekutimit t\u00eb kontejner\u00ebve n\u00eb p\u00ebrb\u00ebr\u00ebs t\u00eb ve\u00e7ant\u00eb? N\u00eb ve\u00e7anti, \u00ebsht\u00eb se k\u00ebto mjete mund t\u00eb fillojn\u00eb t\u00eb kombinohen, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb mbrojn\u00eb nj\u00ebra-tjetr\u00ebn.<\/p>\n

\"Rekomandime
\n
\nP\u00ebr shum\u00eb, ideja e nd\u00ebrtimit t\u00eb imazheve OCI t\u00eb kontejner\u00ebve brenda Kubernetes<\/a><\/noindex> ose nj\u00eb sistemi t\u00eb ngjash\u00ebm \u00ebsht\u00eb errejt\u00ebsuese. Le t\u00eb supozojm\u00eb se kemi nj\u00eb CI\/CD q\u00eb vazhdimisht nd\u00ebrton imazhe, at\u00ebher\u00eb di\u00e7ka si Red Hat OpenShift<\/a><\/noindex>\/Kubernetes \u0431\u044b\u043b\u043e \u0431\u044b \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043b\u0435\u0437\u043d\u043e \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435. \u0414\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u043f\u043e\u0440 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u043b\u044e\u0434\u0435\u0439 \u043f\u0440\u043e\u0441\u0442\u043e \u0434\u0430\u0432\u0430\u043b\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a Docker-\u0441\u043e\u043a\u0435\u0442\u0443 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u0443 docker build. Kemi treguar disa vjet m\u00eb par\u00eb<\/a><\/noindex>, se kjo \u00ebsht\u00eb shum\u00eb e pasigurt, n\u00eb fakt, \u00ebsht\u00eb akoma m\u00eb keq se t\u00eb jap\u00ebsh akses pa fjal\u00ebkalim root ose sudo.
\n<\/a><\/noindex>
\nPrandaj, njer\u00ebzit vazhdojn\u00eb t\u00eb p\u00ebrpiqen t\u00eb ekzekutojn\u00eb Buildah brenda nj\u00eb kontejneri. N\u00eb p\u00ebrmbledhje, ne krijuam shembull<\/a><\/noindex> se si, sipas mendimit ton\u00eb, \u00ebsht\u00eb m\u00eb mir\u00eb t\u00eb ekzekutohet Buildah brenda kontejnerit dhe publikuan p\u00ebrkat\u00ebsisht imazhet n\u00eb quay.io\/buildah<\/a><\/noindex>. Le t\u00eb fillojm\u00eb...<\/p>\n

Konfigurimi<\/h3>\n

\nK\u00ebto imazhe jan\u00eb nd\u00ebrtuar nga Dockerfile, t\u00eb cilat mund t\u00eb gjenden n\u00eb repositorin e Buildah n\u00eb dosjen buildahimage<\/a><\/noindex>.
\nK\u00ebtu do t\u00eb shqyrtojm\u00eb versionin stabil t\u00eb Dockerfile<\/a><\/noindex>.<\/p>\n

# stable\/Dockerfile\n#\n# Build a Buildah container image from the latest\n# stable version of Buildah on the Fedoras Updates System.\n# https:\/\/bodhi.fedoraproject.org\/updates\/?search=buildah\n# This image can be used to create a secured container\n# that runs safely with privileges within the container.\n#\nFROM fedora:latest\n\n# Don't include container-selinux and remove\n# directories used by dnf that are just taking\n# up space.\nRUN yum -y install buildah fuse-overlayfs --exclude container-selinux; rm -rf \/var\/cache \/var\/log\/dnf* \/var\/log\/yum.*\n\n# Adjust storage.conf to enable Fuse storage.\nRUN sed -i -e 's|^#mount_program|mount_program|g' -e '\/additionalimage.*\/a \"\/var\/lib\/shared\",' \/etc\/containers\/storage.conf\n<\/code><\/pre>\n
\nN\u00eb vend t\u00eb OverlayFS, e cila \u00ebsht\u00eb implementuar n\u00eb nivelin e kernelit t\u00eb hostit, ne p\u00ebrdorim brenda kontejnerit programin fuse-overlay<\/a><\/noindex>, sepse aktualisht OverlayFS mund t\u00eb kryej\u00eb montimin vet\u00ebm n\u00ebse i jepet autorizim SYS_ADMIN p\u00ebrmes kapaciteteve t\u00eb Linux it. Ne duam t\u00eb drejtojm\u00eb kontejner\u00ebt tan\u00eb Buildah pa ndonj\u00eb privilegj t\u00eb nivelit root. Fuse-overlay funksionon mjaft shpejt dhe ka performanc\u00eb m\u00eb t\u00eb mir\u00eb se drejtuesi i ruajtjes VFS. Vini re se kur drejtoni nj\u00eb kontejner Buildah q\u00eb p\u00ebrdor Fuse, duhet t\u00eb siguroni pajisjen \/dev\/fuse.<\/p>\n
podman run --device \/dev\/fuse quay.io\/buildahctr ...\nRUN mkdir -p \/var\/lib\/shared\/overlay-images \/var\/lib\/shared\/overlay-layers; touch \/var\/lib\/shared\/overlay-images\/images.lock; touch \/var\/lib\/shared\/overlay-layers\/layers.lock\n<\/code><\/pre>\n
\nP\u00ebr m\u00eb tep\u00ebr, ne krijojm\u00eb nj\u00eb \u043a\u0430\u0442\u0430\u043b\u043e\u0433 p\u00ebr ruajtjet shtes\u00eb. Container\/storage<\/a><\/noindex> mb\u00ebshtet konceptin e lidhjes s\u00eb ruajtjeve shtes\u00eb vet\u00ebm p\u00ebr lexim. P\u00ebr shembull, mund t\u00eb konfiguroni nj\u00eb zon\u00eb ruajt\u00ebse overlay n\u00eb nj\u00eb makin\u00eb, dhe m\u00eb pas t\u00eb montoni k\u00ebt\u00eb ruajtje n\u00eb nj\u00eb makin\u00eb tjet\u00ebr p\u00ebrmes NFS dhe ta p\u00ebrdorni imazhin nga ajo pa e shkarkuar p\u00ebrmes pull. Ne kemi nevoj\u00eb p\u00ebr k\u00ebt\u00eb ruajtje p\u00ebr t\u00eb qen\u00eb n\u00eb gjendje t\u00eb lidhim si nj\u00eb volum ndonj\u00eb ruajtje imazhesh nga host-i dhe ta p\u00ebrdorim at\u00eb brenda kontejnerit.<\/p>\n
# Set up environment variables to note that this is\n# not starting with user namespace and default to\n# isolate the filesystem with chroot.\nENV _BUILDAH_STARTED_IN_USERNS=\"\" BUILDAH_ISOLATION=chroot\n<\/code><\/pre>\n
\nDhe p\u00ebr m\u00eb n\u00eb fund, duke p\u00ebrdorur variabl\u00ebn e ambientit BUILDAH_ISOLATION, ne themi se si standard, kontenieri Buildah duhet t\u00eb ekzekutohet me izolimin chroot. Izolimi shtes\u00eb k\u00ebtu nuk \u00ebsht\u00eb i nevojsh\u00ebm, pasi ne tashm\u00eb po punojm\u00eb brenda nj\u00eb kontenieri. P\u00ebr t\u00eb krijuar kontenier\u00ebt e tij vet\u00eb me ndarje em\u00ebrimi, Buildah k\u00ebrkon privilegjin SYS_ADMIN, dhe p\u00ebr k\u00ebt\u00eb do t\u00eb duhet t\u00eb leht\u00ebsojm\u00eb rregullat SELinux dhe SECCOMP p\u00ebr kontenierin, gj\u00eb q\u00eb \u00ebsht\u00eb n\u00eb kund\u00ebrshtim me vendosjen ton\u00eb p\u00ebr t\u00eb nd\u00ebrtuar nga nj\u00eb kontenier t\u00eb sigurt.<\/p>\n
Startojm\u00eb Buildah brenda kontenierit<\/h3>\n
\nSkema e m\u00ebsip\u00ebrme e imazhit t\u00eb kontenierit Buildah lejon variacione fleksibile n\u00eb m\u00ebnyrat e ekzekutimit t\u00eb k\u00ebtyre kontenier\u00ebve.<\/p>\n
Shpejt\u00ebsia kund\u00ebr siguris\u00eb<\/h4>\n
\nSiguria kompjuterike \u00ebsht\u00eb gjithmon\u00eb nj\u00eb kompromis midis shpejt\u00ebsis\u00eb s\u00eb procesit t\u00eb ekzekutimit dhe sasis\u00eb s\u00eb mbrojtjes q\u00eb \u00ebsht\u00eb vendosur rreth tij. Kjo deklarat\u00eb \u00ebsht\u00eb e v\u00ebrtet\u00eb edhe gjat\u00eb nd\u00ebrtimit t\u00eb kontenier\u00ebve, prandaj m\u00eb posht\u00eb do t\u00eb shqyrtojm\u00eb opsionet e k\u00ebtij kompromisi.<\/p>\n
Imagini q\u00eb u shqyrtua m\u00eb sip\u00ebr do t\u00eb mbaj\u00eb ruajtjen e saj n\u00eb \/var\/lib\/containers. Prandaj, ne duhet t\u00eb montojm\u00eb p\u00ebrmbajtjen n\u00eb k\u00ebt\u00eb dosje, dhe m\u00ebnyra se si do ta b\u00ebjm\u00eb k\u00ebt\u00eb do t\u00eb ndikoj\u00eb shum\u00eb n\u00eb shpejt\u00ebsin\u00eb e nd\u00ebrtimit t\u00eb imazheve t\u00eb konteiner\u00ebve.<\/p>\n
Le t\u00eb shqyrtojm\u00eb tre mund\u00ebsi.<\/p>\n
Mund\u00ebsia 1.<\/b> N\u00ebse k\u00ebrkohet sigurim maksimal, p\u00ebr \u00e7do kontejner mund t\u00eb krijohet nj\u00eb dosje p\u00ebr containers\/image dhe ta lidhim at\u00eb me kontejnerin p\u00ebrmes volume-mount. P\u00ebr m\u00eb tep\u00ebr, mund t\u00eb vendosim dosjen kontekstuale brenda kontejnerit, n\u00eb dosjen \/build:<\/p>\n
# mkdir \/var\/lib\/containers1\n# podman run -v .\/build:\/build:z -v \/var\/lib\/containers1:\/var\/lib\/containers:Z quay.io\/buildah\/stable\nbuildah  -t image1 bud \/build\n# podman run -v \/var\/lib\/containers1:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah  push  image1 registry.company.com\/myuser\n# rm -rf \/var\/lib\/containers1\n<\/code><\/pre>\n
\nSiguria.<\/i> Nj\u00eb kontejner q\u00eb operon me Buildah ofron siguri maksimale: nuk i jepen privilegje root p\u00ebrmes capabilities, dhe i gjitha kufizimet SECOMP dhe SELinux aplikohet mbi t\u00eb. Ky kontejner mund t\u00eb ekzekutohet madje me izolim t\u00eb User Namespace, duke shtuar nj\u00eb opsion si \u2014uidmap 0:100000:10000.<\/p>\n
Performanca.<\/i> Performanca \u00ebsht\u00eb minimale k\u00ebtu, pasi \u00e7do imazh nga regjistrat e kontejner\u00ebve kopjohet \u00e7do her\u00eb n\u00eb host, dhe caching nuk funksionon fare. Pasi t\u00eb p\u00ebrfundoj\u00eb pun\u00ebn e tij, kontejneri Buildah duhet t\u00eb d\u00ebrgoj\u00eb imazhin n\u00eb regjist\u00ebr dhe t\u00eb shkat\u00ebrroj\u00eb p\u00ebrmbajtjen n\u00eb host. Kur imazhi i kontejnerit do t\u00eb grumbullohet s\u00ebrish, do t\u00eb duhet t\u00eb shkarkohet nga regjistri, pasi n\u00eb host deri at\u00ebher\u00eb nuk do t\u00eb mbetet asgj\u00eb.<\/p>\n
Varianti 2.<\/b> N\u00ebse nevojitet performanc\u00eb n\u00eb nivel Docker, at\u00ebher\u00eb mund t\u00eb montoni direkt container\/storage t\u00eb hostit n\u00eb kontejner.<\/p>\n
# podman run -v .\/build:\/build:z -v \/var\/lib\/containers:\/var\/lib\/containers --security-opt label:disabled quay.io\/buildah\/stable buildah  -t image2 bud \/build\n# podman run -v \/var\/lib\/containers:\/var\/lib\/containers --security-opt label:disabled  quay.io\/buildah\/stable buildah push image2 registry.company.com\/myuser\n<\/code><\/pre>\n
\nSiguria.<\/i> Ky \u00ebsht\u00eb m\u00ebnyra m\u00eb e pak sigurta p\u00ebr t\u00eb grumbulluar kontejner\u00eb, pasi k\u00ebtu kontejneri i lejohet t\u00eb modifikoj\u00eb ruajtjen n\u00eb host, dhe potencialisht mund t\u00eb dor\u00ebzoj\u00eb nj\u00eb imazh keqdash\u00ebs te Podman ose CRI-O. P\u00ebr m\u00eb tep\u00ebr, do t\u00eb k\u00ebrkohet t\u00eb \u00e7aktivizohet ndarja SELinux, n\u00eb m\u00ebnyr\u00eb q\u00eb proceset n\u00eb kontejnerin Buildah t\u00eb mund t\u00eb interaktojn\u00eb me ruajtjen n\u00eb host. Vini re se ky variant \u00ebsht\u00eb megjithat\u00eb m\u00eb i mir\u00eb se sa Docker socket, pasi kontejneri \u00ebsht\u00eb bllokuar nga funksione t\u00eb tjera sigurie dhe nuk mund ta marr\u00eb thjesht nj\u00eb kontejner tjet\u00ebr p\u00ebr ta nisur n\u00eb host.<\/p>\n
Performanca.<\/i> K\u00ebtu ajo \u00ebsht\u00eb maksimale, pasi e gjith\u00eb kapaciteti i cache-it shfryt\u00ebzohet plot\u00ebsisht. N\u00ebse Podman ose CRI-O tashm\u00eb kan\u00eb shkarkuar imazhin e nevojsh\u00ebm n\u00eb host, at\u00ebher\u00eb procesi Buildah brenda kontejnerit nuk do t\u00eb duhet ta shkarkoj\u00eb at\u00eb p\u00ebrs\u00ebri, dhe nd\u00ebrtimet e m\u00ebvonshme mbi k\u00ebt\u00eb imazh gjithashtu do t\u00eb ken\u00eb mund\u00ebsi ta marrin nga cache-i.<\/p>\n
Opzioni 3.<\/b> Thelbi i k\u00ebtij metoda \u00ebsht\u00eb t\u00eb bashkoj\u00eb disa imazhe n\u00eb nj\u00eb projekt me nj\u00eb dosje t\u00eb p\u00ebrbashk\u00ebt p\u00ebr imazhet e kontejner\u00ebve.<\/p>\n
# mkdir \/var\/lib\/project3\n# podman run --security-opt label_level=s0:C100, C200 -v .\/build:\/build:z \n-v \/var\/lib\/project3:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah  -t image3 bud \/build\n# podman run --security-opt label_level=s0:C100, C200 \n-v \/var\/lib\/project3:\/var\/lib\/containers quay.io\/buildah\/stable buildah push image3  registry.company.com\/myuser\n<\/code><\/pre>\n
\nN\u00eb k\u00ebt\u00eb shembull, ne nuk e fshijm\u00eb dosjen e projektit (\/var\/lib\/project3) nd\u00ebrmjet ekzekutimeve, prandaj t\u00eb gjitha nd\u00ebrtimet e ardhshme brenda projektit p\u00ebrfitojn\u00eb nga caching.<\/p>\n
Siguria.<\/i> Di\u00e7ka mes opsioneve 1 dhe 2. Nga nj\u00ebra an\u00eb, kontejner\u00ebt nuk kan\u00eb qasje n\u00eb p\u00ebrmbajtjen e hostit dhe, p\u00ebr pasoj\u00eb, nuk mund t\u00eb fusin di\u00e7ka t\u00eb keqe n\u00eb magazin\u00ebn e imazheve t\u00eb Podman\/CRI-O. Nga ana tjet\u00ebr, brenda projektit t\u00eb tij, nj\u00eb kontejner mund t\u00eb nd\u00ebrhyj\u00eb n\u00eb nd\u00ebrtimin e kontejner\u00ebve t\u00eb tjer\u00eb.<\/p>\n
Performanca.<\/i> K\u00ebtu ndodh m\u00eb keq se p\u00ebrdorimi i caches s\u00eb zakonshme n\u00eb nivel hosti, pasi nuk mund t\u00eb p\u00ebrdoren imazhe q\u00eb kan\u00eb shkarkuar m\u00eb par\u00eb me ndihm\u00ebn e Podman\/CRI-O. Megjithat\u00eb, pasi Buildah t\u00eb shkarkoj\u00eb imazhin, ky imazh mund t\u00eb p\u00ebrdoret n\u00eb t\u00eb gjitha nd\u00ebrtimet e m\u00ebpasshme brenda projektit.<\/p>\n
T\u00eb dh\u00ebna shtes\u00eb<\/h4>\n
\nTek containers\/storage<\/a><\/noindex> ka nj\u00eb gj\u00eb kaq t\u00eb shk\u00eblqyer si t\u00eb dh\u00ebnat shtes\u00eb (additional stores), q\u00eb e lejon motor\u00ebt e kontejner\u00ebve t\u00eb p\u00ebrdorin depo t\u00eb jashtme imazhesh n\u00eb modalitetin read-only overlay kur jan\u00eb duke filluar dhe nd\u00ebrtuar kontejner\u00eb. N\u00eb thelb, n\u00eb skedarin storage.conf mund t\u00eb shtoni nj\u00eb ose disa depo \"vet\u00ebm p\u00ebr lexim\" n\u00eb m\u00ebnyr\u00eb q\u00eb motori i kontejner\u00ebve t\u00eb k\u00ebrkoj\u00eb imazhin e nevojsh\u00ebm aty gjat\u00eb fillimit t\u00eb kontejnerit. Ai do t\u00eb shkarkoj\u00eb imazhin nga regjistri vet\u00ebm n\u00eb rast se nuk e gjen at\u00eb n\u00eb asnj\u00eb nga k\u00ebto depo. Motori i kontejner\u00ebve mund t\u00eb shkruaj\u00eb vet\u00ebm n\u00eb depo q\u00eb jan\u00eb t\u00eb aksesueshme p\u00ebr shkrim...<\/p>\n
N\u00ebse rrotullohemi lart dhe shikojm\u00eb Dockerfile-in q\u00eb ne p\u00ebrdorim p\u00ebr nd\u00ebrtimin e imazhit quay.io\/buildah\/stable, at\u00ebher\u00eb ka disa rreshta t\u00eb till\u00eb:<\/p>\n
# Adjust storage.conf to enable Fuse storage.\nRUN sed -i -e 's|^#mount_program|mount_program|g' -e '\/additionalimage.*\/a \"\/var\/lib\/shared\",' \/etc\/containers\/storage.conf\nRUN mkdir -p \/var\/lib\/shared\/overlay-images \/var\/lib\/shared\/overlay-layers; touch \/var\/lib\/shared\/overlay-images\/images.lock; touch \/var\/lib\/shared\/overlay-layers\/layers.lock\n<\/code><\/pre>\n
\nN\u00eb rreshtin e par\u00eb modifikojm\u00eb \/etc\/containers\/storage.conf brenda imazhit t\u00eb en\u00ebve, duke th\u00ebn\u00eb drejtorit t\u00eb ruajtjes t\u00eb p\u00ebrdor\u00eb \"additionalimagestores\" n\u00eb dosjen \/var\/lib\/shared. Nd\u00ebrsa n\u00eb rreshtin e ardhsh\u00ebm krijojm\u00eb nj\u00eb dosje t\u00eb p\u00ebrbashk\u00ebt dhe shtojm\u00eb disa skedar\u00eb lock p\u00ebr t\u00eb shmangur konflikth nga containers\/storage. N\u00eb thelb, thjesht krijojm\u00eb nj\u00eb depo bosh t\u00eb imazheve t\u00eb en\u00ebve. <\/p>\n
N\u00ebse montoni containers\/storage n\u00eb nj\u00eb nivel m\u00eb t\u00eb lart\u00eb se kjo dosje, Buildah do t\u00eb mund t\u00eb p\u00ebrdor\u00eb imazhet.<\/p>\n
Tani le t\u00eb kthehemi te Variant 2 i p\u00ebrmendur m\u00eb lart, kur kontenieri Buildah mund t\u00eb lexoj\u00eb dhe shkruaj\u00eb n\u00eb containers\/store n\u00eb hoste dhe, p\u00ebrkat\u00ebsisht, ka performanc\u00ebn maksimale fal\u00eb ruajtjes t\u00eb imazheve n\u00eb nivelin Podman\/CRI-O, por ofron minimum sigurie, pasi mund t\u00eb shkruaj\u00eb drejtp\u00ebrdrejt n\u00eb depo. Tani do t\u00eb shtojm\u00eb k\u00ebtu depo shtes\u00eb dhe do t\u00eb kemi m\u00eb t\u00eb mir\u00ebn e t\u00eb dy bot\u00ebve.<\/p>\n
# mkdir \/var\/lib\/containers4\n# podman run -v .\/build:\/build:z -v \/var\/lib\/containers\/storage:\/var\/lib\/shared:ro -v  \/var\/lib\/containers4:\/var\/lib\/containers:Z  quay.io\/buildah\/stable \n buildah  -t image4 bud \/build\n# podman run -v \/var\/lib\/containers\/storage:\/var\/lib\/shared:ro  \n-v >\/var\/lib\/containers4:\/var\/lib\/containers:Z quay.io\/buildah\/stable buildah push image4  registry.company.com\/myuser\n# rm -rf \/var\/lib\/continers4\n<\/code><\/pre>\n
\nKujdes, q\u00eb \/var\/lib\/containers\/storage i hostit \u00ebsht\u00eb montuar n\u00eb \/var\/lib\/shared brenda kontejnerit n\u00eb m\u00ebnyr\u00eb read-only. Prandaj, gjat\u00eb pun\u00ebs n\u00eb kontejner, Buildah mund t\u00eb p\u00ebrdor\u00eb \u00e7do imazh q\u00eb \u00ebsht\u00eb shkarkuar m\u00eb par\u00eb nga Podman\/CRI-O (p\u00ebrsh\u00ebndetje, shpejt\u00ebsi), por mund t\u00eb shkruaj\u00eb vet\u00ebm n\u00eb depozit\u00ebn e saj (p\u00ebrsh\u00ebndetje, siguri). Gjithashtu, vini re se kjo b\u00ebhet pa shky\u00e7jen e ndarjes SELinux p\u00ebr kontejnerin.<\/p>\n
Nj\u00eb nuanc\u00eb e r\u00ebnd\u00ebsishme<\/h4>\n
\nAsnj\u00ebher\u00eb nuk duhet t\u00eb fshini ndonj\u00eb imazh nga depozita e poshtme. N\u00eb t\u00eb kund\u00ebrt, konteineri Buildah mund t\u00eb dal\u00eb jasht\u00eb funksionit.<\/p>\n
Dhe k\u00ebto nuk jan\u00eb t\u00eb gjitha p\u00ebrfitimet<\/h4>\n
\nMund\u00ebsit\u00eb e ruajtjeve t\u00eb avancuara nuk kufizohen vet\u00ebm n\u00eb skenarin e p\u00ebrshkruar m\u00eb sip\u00ebr. P\u00ebr shembull, t\u00eb gjitha imazhet e kontejner\u00ebve mund t\u00eb vendosen n\u00eb nj\u00eb ruajtje t\u00eb p\u00ebrbashk\u00ebt rrjeti dhe t'u jepet qasje t\u00eb gjith\u00eb kontejner\u00ebve Buildah. Supozoni se kemi qindra imazhe q\u00eb sistemi yn\u00eb CI\/CD i p\u00ebrdor rregullisht p\u00ebr nd\u00ebrtimin e imazheve t\u00eb kontejner\u00ebve. Konsumojm\u00eb t\u00eb gjitha k\u00ebto imazhe n\u00eb nj\u00eb host t\u00eb vet\u00ebm ruajtjeje dhe pastaj, duke p\u00ebrdorur mjete preferenciale p\u00ebr ruajtjen n\u00eb rrjet (NFS, Gluster, Ceph, ISCSI, S3\u2026), hapim qasje t\u00eb p\u00ebrbashk\u00ebt p\u00ebr k\u00ebt\u00eb ruajtje n\u00eb t\u00eb gjitha nodet Buildah ose Kubernetes.<\/p>\n
Tani mjafton t\u00eb montojm\u00eb k\u00ebt\u00eb magazin\u00eb rrjetore n\u00eb kontejnerin Buildah n\u00eb \/var\/lib\/shared dhe gjith\u00e7ka \u2013 kontejner\u00ebt Buildah nuk do t\u00eb ken\u00eb m\u00eb nevoj\u00eb t\u00eb shkarkojn\u00eb imazhe p\u00ebrmes pull. K\u00ebshtu ne heqim faz\u00ebn e plot\u00ebsimit t\u00eb parakohshme (pre-population) dhe jemi gati t\u00eb nxjerrim kontejner\u00ebt menj\u00ebher\u00eb.<\/p>\n
Natyrisht, kjo mund t\u00eb p\u00ebrdoret si pjes\u00eb e sistemit ekzistues Kubernetes ose infrastruktur\u00ebs s\u00eb konteiner\u00ebve, p\u00ebr t\u00eb nisur dhe ekzekutuar kontejner\u00eb kudo pa shkarkuar imazhe p\u00ebrmes t\u00ebrheqjes. M\u00eb shum\u00eb se kaq, regjistri i kontejner\u00ebve, duke marr\u00eb nj\u00eb k\u00ebrkes\u00eb t\u00eb shtytur p\u00ebr ngarkimin e nj\u00eb imazhi t\u00eb azhurnuar, mund t\u00eb d\u00ebrgoj\u00eb automatikisht k\u00ebt\u00eb imazh n\u00eb nj\u00eb magazin\u00eb t\u00eb p\u00ebrbashk\u00ebt n\u00eb rrjet, ku ai b\u00ebhet menj\u00ebher\u00eb i disponuesh\u00ebm p\u00ebr t\u00eb gjitha nodet.<\/p>\n
Madh\u00ebsit\u00eb e imazheve t\u00eb kontejner\u00ebve ndonj\u00ebher\u00eb mund t\u00eb arrijn\u00eb disa gigabajt. Funksionaliteti i magazinave shtes\u00eb lejon shmangien e klonimit t\u00eb k\u00ebtyre imazheve n\u00eb nodet dhe b\u00ebn q\u00eb nisja e kontejner\u00ebve t\u00eb jet\u00eb praktikisht e menj\u00ebhershme.<\/p>\n
P\u00ebr m\u00eb tep\u00ebr, aktualisht po punojm\u00eb mbi nj\u00eb funksion t\u00eb ri t\u00eb montimeve overlay volume, i cili do ta b\u00ebj\u00eb nd\u00ebrtimin e kontejner\u00ebve edhe m\u00eb t\u00eb shpejt\u00eb.<\/p>\n
P\u00ebrfundimi<\/h3>\n
\nT\u00eb ekzekutosh Buildah brenda nj\u00eb kontejneri n\u00eb mjedisin Kubernetes\/CRI-O, Podman, apo madje n\u00eb Docker \u00ebsht\u00eb plot\u00ebsisht e mundur; p\u00ebr m\u00eb tep\u00ebr, \u00ebsht\u00eb e thjesht\u00eb dhe shum\u00eb m\u00eb e sigurt se p\u00ebrdorimi i docker.socket. Ne kemi rritur ndjesh\u00ebm fleksibilitetin n\u00eb pun\u00ebn me imazhet, dhe tani mund t'i nisni ato n\u00eb m\u00ebnyra t\u00eb ndryshme p\u00ebr nj\u00eb ekuilib\u00ebr optimal midis siguris\u00eb dhe performanc\u00ebs.<\/p>\n
Funksionaliteti i magazinave shtes\u00eb lejon p\u00ebrshpejtimin ose edhe eliminimin e plot\u00eb t\u00eb shkarkimit t\u00eb imazheve n\u00eb nodet.
\n
Burimi: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412 \u0447\u0435\u043c \u043f\u0440\u0435\u043b\u0435\u0441\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435? \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043a\u043e\u043c\u0431\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043e\u043d\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u043b\u0438 \u0434\u0440\u0443\u0433 \u0434\u0440\u0443\u0433\u0430. \u041c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0438\u0434\u0435\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0441\u0431\u043e\u0440\u043a\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 OCI-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Kubernetes \u0438\u043b\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0414\u043e\u043f\u0443\u0441\u0442\u0438\u043c, \u0443 \u043d\u0430\u0441 \u0435\u0441\u0442\u044c CI\/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b, \u0442\u043e\u0433\u0434\u0430 \u0447\u0442\u043e-\u0442\u043e \u0442\u0438\u043f\u0430 Red Hat OpenShift\/Kubernetes \u0431\u044b\u043b\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38785","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47K\u00ebshilla p\u00ebr t\u00eb nisur Buildah brenda nj\u00eb kontejneri | ProHoster","description":"\u00c7far\u00eb \u00ebsht\u00eb bukuria e ndarjes s\u00eb mjedisit t\u00eb ekzekutimit t\u00eb kontejner\u00ebve n\u00eb element\u00eb t\u00eb ve\u00e7ant\u00eb instrumentash? N\u00eb ve\u00e7anti, n\u00eb faktin q\u00eb k\u00ebto mjete mund t\u00eb fillojn\u00eb t\u00eb kombinohen p\u00ebr t\u00eb mbrojtur nj\u00ebri-tjetrin. Shum\u00eb t\u00ebrheq ideja e nd\u00ebrtimit t\u00eb imazheve t\u00eb kontejner\u00ebve OCI brenda Kubernetes ose nj\u00eb sistemi t\u00eb ngjash\u00ebm. Le t\u00eb supozojm\u00eb se kemi nj\u00eb CI\/CD q\u00eb vazhdimisht ndan imazhe, at\u00ebher\u00eb di\u00e7ka si Red Hat OpenShift\/Kubernetes do t\u00eb ishte.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0443 Buildah \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 | ProHoster","og:description":"\u0412 \u0447\u0435\u043c \u043f\u0440\u0435\u043b\u0435\u0441\u0442\u044c \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u0440\u0435\u0434\u044b \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u043d\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435? \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043a\u043e\u043c\u0431\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u043e\u043d\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u043b\u0438 \u0434\u0440\u0443\u0433 \u0434\u0440\u0443\u0433\u0430. \u041c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u0438\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0438\u0434\u0435\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0441\u0431\u043e\u0440\u043a\u0443 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043d\u044b\u0445 OCI-\u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 Kubernetes \u0438\u043b\u0438 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0414\u043e\u043f\u0443\u0441\u0442\u0438\u043c, \u0443 \u043d\u0430\u0441 \u0435\u0441\u0442\u044c CI\/CD, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0437\u044b, \u0442\u043e\u0433\u0434\u0430 \u0447\u0442\u043e-\u0442\u043e \u0442\u0438\u043f\u0430 Red Hat OpenShift\/Kubernetes \u0431\u044b\u043b\u043e","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/rekomendatsii-po-zapusku-buildah-vnutri-kontejnera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:25:55+00:00","article:modified_time":"2019-10-31T19:25:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38785","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:03:14","updated":"2026-01-23 23:24:21"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/38785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=38785"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/38785\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/29093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=38785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=38785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=38785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}