Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

First steps of quadlet integration #1965

Merged
merged 4 commits into from
Jan 17, 2025

Conversation

jelly
Copy link
Member

@jelly jelly commented Jan 15, 2025

Small steps into better supporting quadlets in cockpit-podman.

The visual changes are a new service label to identify quadlet/podman generate systemd managed containers

image

Other changes are:

  • Removing "run healthcheck from the container kebabmenu". This can be done in the details view of a container and doesn't need to be such a prominent feature
  • Hide the rename option for quadet/systemd containers, this likely causes issues as the .container file determines the name of the container allow users to change it will cause issues.

@jelly jelly requested review from garrett and tomasmatus January 15, 2025 12:34
tomasmatus
tomasmatus previously approved these changes Jan 15, 2025
Copy link
Member

@tomasmatus tomasmatus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good and I agree that it makes sense to drop healthcheck from kebab. I only have one minor comment/question on testing. Let's also wait for design review.

test/check-application Outdated Show resolved Hide resolved
@jelly
Copy link
Member Author

jelly commented Jan 16, 2025

We need the tests to check for podman > 4.4 support now as that added quadlets.

garrett
garrett previously approved these changes Jan 16, 2025
Copy link
Member

@garrett garrett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! Looks good to me!

garrett
garrett previously approved these changes Jan 16, 2025
@jelly
Copy link
Member Author

jelly commented Jan 16, 2025

RHEL-8-10 seems broken

[admin@rhel-8-10-127-0-0-2-2201 ~]$ systemctl --user status quadlet.service
● quadlet.service - Podman - quadlet
   Loaded: loaded (/home/admin/.config/containers/systemd/quadlet.container; generated)
   Active: failed (Result: exit-code) since Thu 2025-01-16 11:05:39 EST; 4s ago
  Process: 5475 ExecStopPost=/usr/bin/podman rm -v -f -i --cidfile=/run/user/1000/quadlet.cid (code=exited, status=0/SUCCESS)
  Process: 5462 ExecStart=/usr/bin/podman run --name=quadlet --cidfile=/run/user/1000/quadlet.cid --replace --rm --cgroups=split --sdnotify=conmon -d localhost/test-busybo>
 Main PID: 5462 (code=exited, status=126)

Jan 16 11:05:38 rhel-8-10-127-0-0-2-2201 systemd[2227]: Starting Podman - quadlet...
Jan 16 11:05:39 rhel-8-10-127-0-0-2-2201 quadlet[5462]: Error: mkdir /sys/fs/cgroup/blkio/user.slice/runtime: permission denied
Jan 16 11:05:39 rhel-8-10-127-0-0-2-2201 systemd[2227]: quadlet.service: Main process exited, code=exited, status=126/n/a
Jan 16 11:05:39 rhel-8-10-127-0-0-2-2201 systemd[2227]: quadlet.service: Killing process 5471 (slirp4netns) with signal SIGKILL.
Jan 16 11:05:39 rhel-8-10-127-0-0-2-2201 systemd[2227]: quadlet.service: Failed with result 'exit-code'.
Jan 16 11:05:39 rhel-8-10-127-0-0-2-2201 systemd[2227]: Failed to start Podman - quadlet.

@jelly jelly force-pushed the quadlet-integration branch 2 times, most recently from eaa3eac to e57d1c9 Compare January 17, 2025 09:45
@jelly jelly requested a review from martinpitt January 17, 2025 10:28
martinpitt
martinpitt previously approved these changes Jan 17, 2025
Copy link
Member

@martinpitt martinpitt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! I have a few suggestions for improvements. Depending on your enthusiasm, go ahead as-is, or we do another round.

@@ -2994,6 +3020,13 @@ class TestApplication(testlib.MachineCase):
b.wait_visible(container_1_sel + " .ct-badge-toolbox:contains('toolbox')")
b.wait_visible(container_2_sel + " .ct-badge-distrobox:contains('distrobox')")

if podman_version(self) >= (4, 4, 0):
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not a big fan of this. If this goes wrong in any way, we'll silently skip the test everywhere. There should only be a few OSes which don't have that, and that list will shrink to zero in a controllable way. I.e. I'd prefer a if m.image not in [...] list.

@@ -211,14 +211,15 @@ const ContainerActions = ({ container, healthcheck, onAddNotification, localImag
}
}

const canRename = !isSystemdService && version.localeCompare("3", undefined, { numeric: true, sensitivity: 'base' }) >= 0;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ugh -- this is old code, but it feels like we can drop this now? Our oldest OS Ubuntu 22.04 has podman 3.4

@@ -2986,6 +2986,16 @@ WantedBy=multi-user.target default.target
self.execute(auth, f"podman inspect --format '{{{{.Id}}}}' {container_name_new}").strip()
self.waitContainerRow(container_name_new)

# service containers cannot be renamed
if podman_version(self) >= (4, 4, 0):
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same "meh dynamic check" issue like above.

Copy link
Member

@martinpitt martinpitt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@@ -155,6 +155,7 @@ class TestApplication(testlib.MachineCase):
self.has_criu = "debian" not in m.image and "ubuntu" not in m.image
self.has_selinux = not any(img in m.image for img in ["arch", "debian", "ubuntu", "suse"])
self.has_cgroupsV2 = not m.image.startswith('rhel-8')
self.supports_quadlet = not any(img in m.image for img in ["ubuntu-2204"])
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah sorry, debian stable has 4.3, so that needs to be excluded, too. But TBH I have troubles parsing this "three levels nested" loop. I think what it does is to compare each letter in "ubuntu-2204" against m.image, which really isn't what you want 😁

Could you just do

supports_quadlet = img not in ["debian-stable", "ubuntu-2204"]

please?

jelly added 4 commits January 17, 2025 15:09
Quadlets and containers created by `podman generate systemd` are managed
by systemd and treated more or less read-only in our UI. The first step
is to show them different like we do with toolbox / distrobox containers.
Our lowest supported podman version is 3.4 on Ubuntu 22.04.
This is a footgun for users, the quadlet configuration determines the
container name so allowing a user to rename a container would lead to an
unknown state where the systemd service would name things different then
the running container.
Running a healthcheck is automated in containers so this action does not
need to be prominently advertised in our UI. The health detail tab still
has a button to perform a healtcheck if the user is willing to do so
manually.
@jelly jelly force-pushed the quadlet-integration branch from f6e25ee to 71165c3 Compare January 17, 2025 14:09
@martinpitt
Copy link
Member

This is a 3x affected flake and unrelated, so 👍 Thanks!

@martinpitt martinpitt merged commit daa7054 into cockpit-project:main Jan 17, 2025
18 of 19 checks passed
@jelly jelly deleted the quadlet-integration branch January 17, 2025 14:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants