Add ssh-container example image - #10
Conversation
Signed-off-by: Blake Devcich <blake.devcich@hpe.com>
| @@ -0,0 +1,27 @@ | |||
| apiVersion: nnf.cray.hpe.com/v1alpha7 | |||
| kind: NnfContainerProfile | |||
There was a problem hiding this comment.
I've forgotten how the uid/gid from the Workflow gets communicated to the user-container (oops). Do we have anything in here, maybe in the entrypoint.sh or somewhere else, where we confirm that the Workflow uid/gid matches the uid/gid baked into the image?
There was a problem hiding this comment.
If I'm clever enough to convince the admin to install my containerprofile which points at someone else's image, then that would be bad.
There was a problem hiding this comment.
We run the container with a securityContext and set the UID/GID to the values from the workflow.
You will run into permissions errors when you try to start the container. On htx-1, I created a workflow as matt with my image:
ssh-svr Starting SSH container entrypoint script...
ssh-svr mpiuser
ssh-svr uid=1063(mpiuser) gid=100(users) groups=100(users)
ssh-svr total 16
ssh-svr drwxr-xr-x 1 1060 users 108 Jul 28 12:32 .
ssh-svr drwxr-xr-x 1 root root 21 Oct 12 2024 ..
ssh-svr -rw-r--r-- 1 1060 users 220 Mar 29 2024 .bash_logout
ssh-svr -rw-r--r-- 1 1060 users 3526 Mar 29 2024 .bashrc
ssh-svr -rw-r--r-- 1 1060 users 807 Mar 29 2024 .profile
ssh-svr drwxrwsrwt 3 root users 140 Jul 28 20:54 .ssh
ssh-svr -rw-r--r-- 1 1060 users 90 Oct 12 2024 .sshd_config
ssh-svr drwxr-xr-x 1 1060 users 64 Jul 28 15:27 ssh-session
ssh-svr total 8
ssh-svr drwxr-xr-x 1 1060 users 64 Jul 28 15:27 .
ssh-svr drwxr-xr-x 1 1060 users 108 Jul 28 12:32 ..
ssh-svr drwxr-xr-x 1 1060 users 81 Jul 28 15:27 keys
ssh-svr -rw-r--r-- 1 1060 users 747 Jul 28 15:27 keysmpiuser_key.pub
ssh-svr -rw-r--r-- 1 1060 users 167 Jul 28 15:27 sshd_config
ssh-svr /entrypoint.sh: 11: cannot create /home/mpiuser/ssh-session/env.sh: Permission denied
There was a problem hiding this comment.
Thanks for confirming.
There was a problem hiding this comment.
And even if you got past this part, ssh most likely wouldn't work unless you baked in the same public key.
4 participants
Start with the README.md