What is the current best-practice for running buildah in a docker container?

[rgilton]

I would like to run buildah inside of a container that is running on a docker host. I would like to do this without having to use the --privileged flag. I have read the Redhat article "Best practices for running Buildah in a container", and that all works if I run buildah in podman, but I don't seem to be able to come up with the correct incantation to get it to run in docker.

Does anyone know how to do this?

(Part of the reason I ask is that we have a gitlab runner that is docker based. Gitlab doesn't yet support podman, so we are stuck with it for the time being.)

[rhatdan]

Can you disable the seccomp filters?

[rgilton]

Looks like you nailed the reason it's not working!

My current command is:

docker run -ti --rm --security-opt=seccomp:unconfined \
        --device /dev/fuse \
        --security-opt=label:disable \
        quay.io/buildah/stable:v1.23.3 bash

It seems like I should be able to improve upon the seccomp filter, as I imagine that there's only a few syscalls that need to be allowed through to get buildah to work. Any idea what they are?

As an aside, it seems like it might be possible to write a container image that inspects the environment that it's running in, and reports back why buildah won't work within it. Would be a handy tool!

[rhatdan]

I think it is the unshare and mount syscalls. I you have podman installed, you can also do.

docker run -ti --rm --security-opt=seccomp:/usr/share/containers/seccomp.json \
        --device /dev/fuse \
        quay.io/buildah/stable:v1.23.3 bash

You should not need to disable SELinux.

[rgilton]

Thanks! Yes, the seccomp filters work if I bring that seccomp.json in from another machine with podman on it. Disabling selinux does not work though:

[rob@marvin-runner ~]$ sudo docker run -ti --rm --security-opt=seccomp:seccomp.json --device /dev/fuse quay.io/buildah/stable:v1.23.3 bash
[root@ea6356a26a7b /]# buildah from --name foo alpine:latest
Resolved "alpine" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull docker.io/library/alpine:latest...
Getting image source signatures
Copying blob df9b9388f04a done  
Copying config 0ac33e5f5a done  
Writing manifest to image destination
Storing signatures
foo
[root@ea6356a26a7b /]# buildah run foo echo hi
error running subprocess: error making sure directory "/var/tmp/buildah596965242/mnt/rootfs/sys/dev" in mount namespace is read only: permission denied
                                                                                                                                                       exit status 1
ERRO[0000] exit status 1                                

[rhatdan]

Could you paste in the AVC messages.
$ sudo ausearch -m avc -ts recent

[rgilton]

[rob@marvin-runner ~]$ sudo ausearch -m avc -ts recent
----
time->Fri Apr 29 14:11:37 2022
type=AVC msg=audit(1651237897.819:495927): avc:  denied  { remount } for  pid=257175 comm="exe" scontext=system_u:system_r:container_t:s0:c529,c599 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0
----
time->Fri Apr 29 14:11:43 2022
type=AVC msg=audit(1651237903.510:495928): avc:  denied  { remount } for  pid=257218 comm="exe" scontext=system_u:system_r:container_t:s0:c529,c599 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0
----
time->Fri Apr 29 14:11:43 2022
type=AVC msg=audit(1651237903.778:495929): avc:  denied  { remount } for  pid=257284 comm="5" scontext=system_u:system_r:container_t:s0:c529,c599 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0
[rob@marvin-runner ~]$