4

我想使用 gitlab-ci 中的 buildah 来构建图像，从中运行容器并对其进行一些测试。

我目前的 gitlab-ci 是：

tests:
  tags:
    - docker
  image: quay.io/buildah/stable
  stage: test
  variables:
      STORAGE_DRIVER: "vfs"
      BUILDAH_FORMAT: "docker"
      BUILDAH_ISOLATION: "rootless"
  only:
    refs:
      - merge_requests
    changes:
      - **/*
  script:
    - buildah info --debug
    - buildah unshare docker/test/run.sh

我的跑步者是私人 gitlab 跑步者，我不想改变它的配置（为了不破坏其他 CI）。

run.sh 的内容是：

#!/usr/bin/env bash
set -euo pipefail
container=$(buildah --ulimit nofile=8192 --name my-container from phusion/baseimage:bionic-1.0.0-amd64)

错误是：

level=warning msg="error reading allowed ID mappings: error reading subuid mappings for user \"root\" and subgid mappings for group \"root\": No subuid ranges found for user \"root\" in /etc/subuid" level=warning msg="Found no UID ranges set aside for user \"root\" in /etc/subuid." level=warning msg="Found no GID ranges set aside for user \"root\" in /etc/subgid." No buildah sali-container already exists... Package Sali Creating sali-container Completed short name "phusion/baseimage" with unqualified-search registries (origin: /etc/containers/registries.conf) Getting image source signatures Copying blob 
sha256:36505266dcc64eeb1010bd2112e6f73981e1a8246e4f6d4e287763b57f101b0b Copying blob 
sha256:1907967438a7f3c5ff54c8002847fe52ed596a9cc250c0987f1e2205a7005ff9 Copying blob 
sha256:23884877105a7ff84a910895cd044061a4561385ff6c36480ee080b76ec0e771 Copying blob 
sha256:2910811b6c4227c2f42aaea9a3dd5f53b1d469f67e2cf7e601f631b119b61ff7 Copying blob 
sha256:bc38caa0f5b94141276220daaf428892096e4afd24b05668cd188311e00a635f Copying blob 
sha256:53c90fd859186b7b770d65adcb6ae577d4c61133f033e628530b1fd8dc0af643 Copying blob 
sha256:d039079bb3a9bf1acf69e7c00db0e6559a86148c906ba5dab06b67c694bbe87c Copying config 
sha256:32c929dd2961004079c1e35f8eb5ef25b9dd23f32bc58ac7eccd72b4aa19f262 Writing manifest to image destination Storing signatures level=error msg="Error while applying layer: ApplyLayer
 exit status 1 stdout:  stderr: potentially insufficient UIDs or GIDs available in user namespace (requested 0:42 for /etc/gshadow): Check /etc/subuid and /etc/subgid: lchown /etc/gshadow: invalid argument" 4 errors occurred while pulling:  
* Error initializing source docker://registry.fedoraproject.org/phusion/baseimage:bionic-1.0.0-amd64: Error reading manifest bionic-1.0.0-amd64 in registry.fedoraproject.org/phusion/baseimage: manifest unknown: manifest unknown  
* Error initializing source docker://registry.access.redhat.com/phusion/baseimage:bionic-1.0.0-amd64: Error reading manifest bionic-1.0.0-amd64 in registry.access.redhat.com/phusion/baseimage: name unknown: Repo not found  
* Error initializing source docker://registry.centos.org/phusion/baseimage:bionic-1.0.0-amd64: Error reading manifest bionic-1.0.0-amd64 in registry.centos.org/phusion/baseimage: manifest unknown: manifest unknown  
* Error committing the finished image: error adding layer with blob "sha256:23884877105a7ff84a910895cd044061a4561385ff6c36480ee080b76ec0e771": ApplyLayer exit status 1 stdout:  stderr: potentially insufficient UIDs or GIDs available in user namespace (requested 0:42 for /etc/gshadow): Check /etc/subuid and /etc/subgid: lchown /etc/gshadow: invalid argument level=error msg="exit status 125" level=error msg="exit status 125"

结果buildah info --debug：

{
    "debug": {
        "buildah version": "1.18.0",
        "compiler": "gc",
        "git commit": "",
        "go version": "go1.15.2"
    },
    "host": {
        "CgroupVersion": "v1",
        "Distribution": {
            "distribution": "fedora",
            "version": "33"
        },
        "MemFree": 9021378560,
        "MemTotal": 15768850432,
        "OCIRuntime": "runc",
        "SwapFree": 0,
        "SwapTotal": 0,
        "arch": "amd64",
        "cpus": 4,
        "hostname": "runner-cvBUQadt-project-2197143-concurrent-0",
        "kernel": "4.14.83+",
        "os": "linux",
        "rootless": false,
        "uptime": "6391h 28m 15.45s (Approximately 266.29 days)"
    },
    "store": {
        "ContainerStore": {
            "number": 0
        },
        "GraphDriverName": "vfs",
        "GraphOptions": [
            "vfs.imagestore=/var/lib/shared"
        ],
        "GraphRoot": "/var/lib/containers/storage",
        "GraphStatus": {},
        "ImageStore": {
            "number": 0
        },
        "RunRoot": "/var/run/containers/storage"
    }
}

我阅读了其他有关我遇到的错误的帖子并来到了这个配置，这还不够。我选择 buildah 是因为认为它很容易从 CI 中使用，因为它应该可以无根运行，但这是一场真正的噩梦……我是可怜的孤独开发人员，而不是系统管理员，我不明白如何设置 linux为 buildah ...有人可以帮助我吗？

4

1 回答 1

3

Buildah 将需要以 root 身份运行或在具有足够 UID 的用户命名空间中运行，以安装具有不同 UID 的文件。

这看起来像出于某种原因 buildah 认为它应该在用户命名空间中运行，然后没有找到在用户命名空间中列出的 root。这通常发生在您没有以足够的权限运行时。

于 2021-01-08T13:59:26.757 回答