os: Add a default shell to mini-os#37
Conversation
| DNF="$DNF --config=$DNF_CONF -y --installroot=${ROOTFS_DIR} --noplugins" | ||
| $DNF install systemd hyperstart cc-oci-runtime-extras coreutils-bin \ | ||
| systemd-bootchart iptables-bin clear-containers-agent ${EXTRA_PKGS} | ||
| systemd-bootchart iptables-bin clear-containers-agent bash-bin ${EXTRA_PKGS} |
There was a problem hiding this comment.
hey @devimc, it does not. It a request to allow to debug the vm.
There was a problem hiding this comment.
my vote that if this is only for debug the developer build their own image (with this tool) with bash included, and we do not need to ship with bash for security risks.
Documentation will fix that IMHO
There was a problem hiding this comment.
How is the security risk different between us including as shell and the user of the container who normally already has access to a shell as part of the container workload. If there is a material difference between the two then it makes a difference. If not we are just sacrificing usability.
So the question is, how is this shell different from the shell available in the workload. Both are root.
There was a problem hiding this comment.
@mcastelino well, if we provide bash this is the vm rootfs, the shell that is provided with the workload is in another layer, limited within the container - imho - correct me if I am wrong.
Need to provide a shell for vm debuging. Fixes: clearcontainers#36 Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
|
Since this tool creates custom images for development/debugging, I think giving the ability to add a shell is reasonable in most scenarios. However, this might not be required for some users and does bloat the image beyond the current minimal config. As such, why not add an option / env var to also have a shell included? Alternatively, we could just document in |
|
Any update on this? |
|
@jcvenegas @jodh-intel @sameo @grahamwhaley can we close on this. |
5 participants
Need to provide a shell for vm debuging.
Fixes: #36
Signed-off-by: Jose Carlos Venegas Munoz jose.carlos.venegas.munoz@intel.com