-
Notifications
You must be signed in to change notification settings - Fork 45
Podman updates & More Competition container security #1871
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
…container to launch containers on host instead of inside the container
…socket connections issues
…ll to the submission container launch options, changed volume mounting option for podman
|
I also wanted to note that I don't think the Circle-CI tests does anything with podman images, I am pretty sure that it only uses docker images build from Dockerfiles |
|
✅ Test 1: Test if submission works using docker container (testing changes in compute_worker.py) |
|
It works on a fresh Almalinux 9.6 install with podman 5.4.0. I haven't tested it with GPUs at the moment, though. |
…pants and 25 submissions that are private
A brief description of the purpose of the changes contained in this PR.
This PR updates the
Containerfile.compute_worker_podmanandContainerfile.compute_worker_podman_gpu.Updated base image version to get the latest security fixes, removed all the unnecessary lines to create lighter images (especially the GPU image)
I also updated the
compute_worker.pyfile to add more security and make it more compatible to Podman.Checklist for hand testing
For Docker compute workers (compute_worker.py updates)
For Podman
systemctl --user enable --now podmanpodman build -t codalab/codabench_worker_podman:latest -f Containerfile.compute_worker_podman/codabenchfolderdatafolder inside the/codabenchsudo chown -R user:user /codabench).envfile.envfile is, or change the launch command below to have the full path of the.env):GPU command :
Checklist