<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div><div style="white-space:normal">
<p dir="auto">Yeah, if CDK was running with this enabled I would not be able to run anything <br>
in any meaningful timeframe on openshift.</p>
<p dir="auto">I wish there was a better way though.</p>
<p dir="auto">i.e. that I could set a flag for a specific deployment wether<br>
it should be allowed to run as root or not without making this a fully global flag.</p>
<p dir="auto">But in short - without this permission I don't see CDK/ADB being useful to anyone<br>
trying to use it for docker based development because dockerhub just has too many<br>
containers that requires it.</p>
<p dir="auto">/max</p>
<blockquote style="border-left:2px solid #3983C4; color:#3983C4; margin:0 0 5px; padding-left:5px">
</blockquote></div>
<blockquote style="border-left:2px solid #3983C4; color:#3983C4; margin:0 0 5px; padding-left:5px"><div dir="ltr">I think most teams at the Brno F2F were struggling with this. It works locally, but semi-obscure failures when pushed 'live'. And out of the 30 RH engineers there, none knew 100% or was able to dig up a doc that explained why and how to fix it...<div><br></div><div>This is/will be a massive pain point moving from Dev to Production. The very least we need some very clear, simple guides on how to make it work. </div><div><br></div><div>-aslak- </div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, May 18, 2016 at 1:10 PM, Clayton Coleman <span dir="ltr"><<a href="mailto:ccoleman@redhat.com" target="_blank">ccoleman@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">It was a deliberate choice, predicated on other changes coming to<br>
Docker (user namespaces) plus the desire to ensure demos run.<br>
<br>
Ultimately, the CDK is a playground. Putting up chain link fences<br>
around the playground sends the wrong message.<br>
<br>
I'd prefer to have it easier to go between the levels in the short<br>
term than to ratchet it back.<br>
<div class="HOEnZb"><div class="h5"><br>
> On May 17, 2016, at 11:27 PM, Dusty Mabe <<a href="mailto:dusty@dustymabe.com">dusty@dustymabe.com</a>> wrote:<br>
><br>
><br>
> Currently we are configuring openshift in the CDK/ADB to be more<br>
> permissive than it should be when running containers.<br>
><br>
> At [1] we are setting:<br>
><br>
> oadm policy add-scc-to-group anyuid system:authenticated<br>
><br>
> From my experiments this means that containers run as anyuid and thus<br>
> can be root, cc clayton for confirmation.<br>
><br>
> What this means is that we are misleading users to thinking things<br>
> will run in production OpenShift, when the production OpenShift most<br>
> likely won't have things configured this way.<br>
><br>
> We should probably not be doing this. Reverting this change will also<br>
> mean that proposed demos, etc.. should be retested on the newer version<br>
> meticulously.<br>
><br>
> Dusty<br>
><br>
> [1] <a href="https://github.com/projectatomic/adb-utils/blob/01adadd904dea98033c9c83d0648d90f5e8f2806/services/openshift/scripts/openshift_provision#L47" rel="noreferrer" target="_blank">https://github.com/projectatomic/adb-utils/blob/01adadd904dea98033c9c83d0648d90f5e8f2806/services/openshift/scripts/openshift_provision#L47</a><br>
<br>
_______________________________________________<br>
Devtools mailing list<br>
<a href="mailto:Devtools@redhat.com">Devtools@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/devtools" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/devtools</a><br>
</div></div></blockquote></div><br></div></blockquote>
<div style="white-space:normal">
<blockquote style="border-left:2px solid #3983C4; color:#3983C4; margin:0 0 5px; padding-left:5px">
<hr>
<p dir="auto">Devtools mailing list<br>
<a href="mailto:Devtools@redhat.com">Devtools@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/devtools">https://www.redhat.com/mailman/listinfo/devtools</a></p>
</blockquote>
<p dir="auto">/max<br>
<a href="http://about.me/maxandersen">http://about.me/maxandersen</a></p>
</div>
</div>
</body>
</html>