diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-15 13:14:46 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-15 13:14:46 +0000 |
| commit | 025c439e829e0db9ac511cd9c1b8d5fd53475ead (patch) | |
| tree | fa6986b4690f991613ffb97cea1f6942427baf5d /docker/README | |
| parent | Initial commit. (diff) | |
| download | sudo-05ae7ad340f23eb918a40c175f781eff7823df3f.tar.xz sudo-05ae7ad340f23eb918a40c175f781eff7823df3f.zip | |
Adding upstream version 1.9.15p5.upstream/1.9.15p5upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'docker/README')
| -rw-r--r-- | docker/README | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/docker/README b/docker/README new file mode 100644 index 0000000..679446b --- /dev/null +++ b/docker/README @@ -0,0 +1,45 @@ +Container images are stored in https://hub.docker.com/repositories as +user sudoproject. Build images are named based on the distro and use +the tag to differentiate between different versions and architectures. +There should always be a "latest" tag (or manifest). + +When creating a new Dockerfile, use one of the Debian or Fedora files +as a template. The examples below use podman rather than docker but it +should be possible to them interchangeably. + +To build Debian containers for both amd64 and i386 (others only have amd64): + + podman build --arch amd64 --pull -t sudoproject/debian:latest.amd64 \ + docker/debian/latest + podman build --arch 386 --pull -t sudoproject/debian:latest.i386 \ + docker/debian/latest + +Then push it to dockerhub (may need to run "podman login" first): + podman push sudoproject/debian:latest.amd64 + podman push sudoproject/debian:latest.i386 + +Multi-arch containers are supported by creating a manifest, e.g.: + podman manifest create sudoproject/debian:latest + podman manifest add sudoproject/debian:latest \ + sudoproject/debian:latest.amd64 + podman manifest add sudoproject/debian:latest \ + sudoproject/debian:latest.i386 + +Finally push the manifest to dockerhub: + podman push sudoproject/debian:latest + +When building bleeding edge images it is possible that the seccomp +filter will be out of date with respect to system calls. It may +be necessary to pass podman the --security-opt=seccomp=unconfined +option in this case. + +Note that memory sanitizer uses ptrace which is not allowed for +non-root containers by default. This will cause a failure when +running the tests if sudo is configured with --enable-sanitizer. +The simplest solution is to run the container with the SYS_PTRACE +capability. E.g. + podman run -it --cap-add SYS_PTRACE ... + +Alternately, disable leak sanitizer by setting + ASAN_OPTIONS=detect_leaks=0 +in the environment of the container doing "make check". |