openstack/kolla.git/docker/glance/glance-base/Dockerfile.j2, branch zed-eol

Fix writable rootwrap/privsep config

2022-10-10T15:06:05+00:00

Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298

flatten images a bit

2022-04-21T18:53:14+00:00

As we have one type of images now some RUN calls could be merged so we will have less layers in resulting images. Change-Id: I5178c58fbd8c65efe825dc249c0f1368ef0fe8e0

Adjust permissions on _extend_start files.

2022-04-11T15:22:24+00:00

Explicitly set the permissions on the kolla-toolbox kolla_extend_start file. Also, since all extend_start files are sourced rather than executed, the executable bits are now cleared throughout the project. Change-Id: I5c2deb4a2e33575d57c852089f856a9acc6818d0

docker: drop binary parts

2022-04-09T15:44:26+00:00

Big patch drops all mentions of binary images support. Suggestions are welcome how to split it into parts or handle better. Change-Id: I5d5a46c6ce7734ceb8b844e17b43e359d7cac6e3

Add boto3 as s3 dependency for Glance container

2021-07-27T22:05:19+00:00

boto3 library is needed [1] for glance_store and didn't installed yet since [2] adds s3 support back. this change adds both binary and source parts to install boto3 library. 1. https://github.com/openstack/glance_store/blob/04e5ead7c000211a4c10104ed2bb65c9df7681ae/setup.cfg#L76 2. I203134837319080ead96da69048baf90086d2117 Closes-Bug: #1884259 Change-Id: I199185e24cedd2e282c53460a24aeffc83478a12 Signed-off-by: Maksim Malchuk

Merge "Fix glance-api privsep errors"

2020-04-15T14:28:07+00:00

Remove support for CentOS 7

2020-04-15T09:32:06+00:00

With the move to RHEL/CentOS 8 we no longer have Python 2 in our images so there is no need for checking which Python version (2.x or 3.x) is used inside of containers. We also no longer have to support yum as a value for distro_package_manager. Partially-Implements: blueprint centos-rhel-8 Change-Id: Ie45cf3465fedddbde7856961527421883ba3d5c9

Fix glance-api privsep errors

2020-04-03T10:57:35+00:00

This fixes usage of cinder as glance backend. Glance API source containers were missing both sudoers and rootwrap config. rootwrap config gets included in Kolla because otherwise it is clunky to get it from glance_store where it lives. The positive side is that it has not changed since July 2016. Debian/Ubuntu binary have weird double-glance path to rootwrap which gets fixed now by symbolic link. Closes-bug: #1869072 Change-Id: Ia53657a415249882b93acca86b5e2a3bfa167820

Use StorageSIG repos for Ceph in CentOS8

2020-03-03T11:01:53+00:00

Storage SIG has built Ceph Nautilus and Ganesha for CentOS8 in CentOS Build System. Let's switch to use them in kolla. Change-Id: Id37dca84c4eb918aaf2d3c036ef5387fe75988dd

Add block labels to all Dockerfiles

2020-03-01T17:25:58+00:00

Change-Id: I9692dda817ef134d647247431565e1b58cf9da41