aboutsummaryrefslogtreecommitdiff
path: root/kolla/image/tasks.py
AgeCommit message (Collapse)AuthorFilesLines
2026-09-16Ensure git cloned dirs are writable for the executing userMichal Nasiadka1-0/+6
Closes-Bug: #2167377 Change-Id: Ic5e32b79d058223634d990fb2e33041692f682ce Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-30Move PIP_* env variables to ARG and configMichal Nasiadka1-0/+9
Leaving empty CI template_overrides file in case we need to use it in future. Change-Id: Ic46f1a594bcc330536bc78d93ece10e60622f6d4 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-07-23Rework tar normalization to a shared functionMichael Sherman1-24/+20
Add missing tests Change-Id: I91b42fe530f87af7d78bb1a543b29a4b0d50872e Signed-off-by: Michael Sherman <shermanm@uchicago.edu>
2026-06-24kolla-build: normalize mtime in archive creationMichal Nasiadka1-0/+3
The reset_userinfo tar filter used when creating plugins and additions archives normalized uid/gid but left mtime untouched. Since archives are created after set_time() has already run, and the default working directory is a fresh temp dir per invocation, the embedded directory mtime was always the current time. Docker computes a content checksum for ADD instructions, so a different mtime in the tar produced a different checksum on every run. Fix by setting tarinfo.mtime = 0 in both reset_userinfo filters and calling os.utime(arc_path, (0, 0)) on the archive file after creation, making the archives binary-identical across runs for the same content. Change-Id: I205dab2c4a74fb9e3cb15c421d5c025849f5632a Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-24kolla-build: fix build-date LABEL invalidating Docker layer cacheMichal Nasiadka1-0/+1
The build-date label was rendered into a LABEL instruction on line 3 of every Dockerfile template, immediately after FROM. Because Docker invalidates the cache for a changed instruction and all subsequent layers, a date change caused a full rebuild of every image on each new calendar day, even when nothing else had changed. Fix this by removing build-date from the Dockerfile templates and applying it as a --label argument at build time via image.labels. Labels passed on the build command line are not part of the Dockerfile cache key, so the date is still recorded in the image metadata without affecting layer caching. Change-Id: I8ef0d85bab1a999a4d09f7cbf0c088ca00fdcf77 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-06-18kolla-build: Add Docker BuildKit support via docker buildx buildMichal Nasiadka1-1/+93
Add --buildkit flag to use docker buildx build instead of the docker-py SDK. An optional --buildkit-builder selects a named buildx builder instance, enabling docker-container or remote drivers for multi-arch builds. --buildkit and --squash are mutually exclusive and rejected at startup. PushTask is skipped when buildkit is active; push is handled inline. Set buildkit as the new default. Change-Id: Idbf1d1bdc091bb84721f8006c2b916731b999859 Signed-off-by: Michal Nasiadka <mnasiadka@gmail.com>
2026-03-30Add OCI standard labels to container imagesPiotr Milewski1-0/+3
Currently, Kolla images lack standard metadata, making it difficult to identify their build source, creation time, or exact version solely by inspecting the image artifact. This patch introduces the addition of Open Container Initiative (OCI) standard labels to all generated images. The build process now detects metadata (utilizing `direct_url.json` for pip-installed packages to avoid subprocess calls) and injects the following labels into the container runtime config: * org.opencontainers.image.authors * org.opencontainers.image.created * org.opencontainers.image.description * org.opencontainers.image.licenses * org.opencontainers.image.revision * org.opencontainers.image.source * org.opencontainers.image.title * org.opencontainers.image.url * org.opencontainers.image.version Example output: "Labels": { "org.opencontainers.image.authors": "Kolla Project (https://launchpad.net/kolla)", "org.opencontainers.image.created": "2025-12-22T14:02:47.015819", "org.opencontainers.image.description": "OpenStack Kolla keystone-ssh image", "org.opencontainers.image.licenses": "Apache-2.0", "org.opencontainers.image.revision": "96b54022857ccef8dc6bb11789abe32119827109", "org.opencontainers.image.source": "https://opendev.org/openstack/kolla", "org.opencontainers.image.title": "keystone-ssh", "org.opencontainers.image.url": "https://opendev.org/openstack/kolla", "org.opencontainers.image.version": "master-ubuntu-noble" } This enhancement improves the interoperability of Kolla images with standard container tools and registries that display OCI metadata. Change-Id: I3451940c90180ba91759c839987434e94251e32e Signed-off-by: Piotr Milewski <vurmil@gmail.com>
2025-08-06send empty X-Registry-Auth for anonymous pushesBartosz Bezak1-0/+10
Since Docker 28.3.3 the daemon rejects a push that carries no `X-Registry-Auth` header [1]. The SDK already sets this header when it finds credentials, so the breakage happens only on anonymous pushes. During `PushTask.push_image()` we now check whether the SDK can resolve credentials for the target registry; if it cannot, we inject `auth_config={}`, causing the SDK to send the minimal "{}" header that satisfies the daemon while leaving authenticated pushes unchanged. Drop this addition when [2] is fixed. [1] https://github.com/moby/moby/pull/50371 [2] https://github.com/docker/docker-py/issues/3348 Closes-Bug: #2119619 Change-Id: I7a2f3fce223afd74741b40bf62836b325fca5b19 Signed-off-by: Bartosz Bezak <bartosz@stackhpc.com>
2025-02-19Remove Git remote origin after cloning sourcesMichal Arbet1-0/+1
When kolla is cloning a Git repository during the build process, the `.git/config` file retains the remote origin URL, which may expose sensitive credentials if authentication tokens are embedded in the URL. This fix ensures that the remote is removed after cloning to prevent unintended exposure of credentials. Closes-Bug: #2098904 Change-Id: Iec21fc2363e03133ec77326da7392bc25b40132a
2024-08-27Check if archive is tarfileMichal Nasiadka1-3/+8
Change-Id: I802267d848c1dee722015b0d379bd9210f6c103e
2024-03-28Merge "add: cross-compile support"Zuul1-0/+1
2024-02-21Move curl sources to sources.pyMichal Nasiadka1-0/+12
Move most curl sources to sources.py, so it can be automatically updated in future. This also makes overriding the versions/locations/sha256 easier. Change-Id: Ib3497fe96162ae190e5c113cacaaa3ef8334f590
2024-02-08add: cross-compile supportTadas Sutkaitis1-0/+1
The main goal is to be able to build ARM images on standard x86 hardware. Add simple functions supported by python-py and podman-py to enable creation of container images on emulated architectures. Change-Id: I1526b460f6e271c2ec63ab3a3b1dc348d742e96d
2023-11-28Handle the case where docker is not availableBartosz Bezak1-1/+6
Change-Id: I473ea1c68d2fd7f15fa0545d77892276b1accfeb
2023-09-29Fix build errors missing podman/docker moduleMichal Nasiadka1-9/+12
Example: Traceback (most recent call last): File "/home/ubuntu/kolla/kolla/image/build.py", line 79, in run task.run() File "/home/ubuntu/kolla/kolla/image/tasks.py", line 144, in run self.builder(self.image) File "/home/ubuntu/kolla/kolla/image/tasks.py", line 424, in builder if isinstance(e, podman.errors.exceptions.BuildError): NameError: name 'podman' is not defined Change-Id: I947c77750b3ccfb975e010c2042a3716e3e46bde
2023-09-21Add podman for image buildingMichal Arbet1-1/+28
Add podman as an option to choose for container engine for kolla-build (--engine podman) Signed-off-by: Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com> Co-Authored-By: Michal Arbet <michal.arbet@ultimum.io> Change-Id: I068c906df97745e397408d8c3ef6af47ee037638
2023-09-14Fix stderr logging when image build failMichal Arbet1-1/+8
Change-Id: Ie8730ae44cc26b87bd7eac93c8aac8dce8c7c5fc
2023-08-28Transition to DockerClientMichal Nasiadka1-17/+27
Change to use docker.DockerClient instead of the low level docker.APIClient. Signed-off-by: Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com> Change-Id: I88842c17d8e6ddbe89b984c7b5e0367ed356fa50
2023-03-31Fix test malicious tarball failMichal Nasiadka1-1/+1
Since I650fcbc8f773fad8116338f6fb0cf7b4f4f17b33 builds from git fails on plugins with an exception: 'tarfile.ReadError: not a gzip file' because the test checks only gzip compressed archives but plugins created as plain tar files. This change fixes the issue using transparent compression support and also adds some debug info. Closes-Bug: #1990432 Change-Id: If0f9b4dd058a257d0653332d1b663e150c717304 Signed-off-by: Maksim Malchuk <maksim.malchuk@gmail.com> Co-Authored-by: Michal Nasiadka <mnasiadka@gmail.com>
2023-03-17Test for unsafe files in tarfile.extractallMichal Nasiadka1-1/+10
In addition to that, mark bifrost unbuildable since it's failing on EPEL 9 enablement. Closes-Bug: #1990432 Change-Id: I650fcbc8f773fad8116338f6fb0cf7b4f4f17b33
2023-02-27Merge "Add a way to add other container engines"Zuul1-39/+42
2022-11-30Fix plugin builds with sources using type=gitJakub Neumann1-1/+11
A recent change to git [1] introduced a new behaviour to work around a CVE [2] that disallows any git operations in directories not owned by the current user. A fix was introduced for general checkouts, but it was not applied to the plugins archive, resulting in PBR still not working as intended. [1] https://github.com/git/git/commit/8959555cee7ec045958f9b6dd62e541affb7e7d9 [2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24765. Closes-Bug: #1969096 Related-Bug: #1968877 Co-Authored-By: Mark Goddard <mark@stackhpc.com> Co-Authored-By: Marcin Juszkiewicz <marcin.juszkiewicz+kolla@linaro.org> Signed-off-by: Jakub Neumann <jneumann@cloudferro.com> Change-Id: Ib3a37eebb29d975fc51a117cecdff74baafd8941
2022-11-08Add a way to add other container enginesMarcin Juszkiewicz1-39/+42
Add engine adapter module to allow additon of other container engines, create one common EngineClient that would be called in all other modules. Based on patch by Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com> Change-Id: Ice6467086bd292af086322afc3fc4e869d89eefa
2022-10-06Move build related tasks to separate fileMarcin Juszkiewicz1-0/+397
As part of kolla/image/ refactoring we move build related task classes into own file. Based on patch by Konstantin Yarovoy <konstantin.yarovoy@tietoevry.com> Change-Id: I093620679016b37e1664c9fe4cf7559433e744b7
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-06 03:20:32 +0000