OCI images is very exciting. But, I don't see any way to keep them updated. You don't normally do an update on the applications inside an OCI container, you usually rebuild the container on a new image.
Right, but these containers are usually not designed to be updated like that. It totally defeats the nature of the OCI image and delivering something that has been tested to work. I'm sure there is a use case for this, but it seems more like a gimmick than a useful feature.
Back into an OCI image? I don't know if lxc can do that, but podman can. I think it is podman save that allows you to save your current container as an image. Or, even better would be to use buildah. With buildah your expected workflow is to kind of run a container, run a script against that container, then save it at the end. In fact I'm specifically thinking of images I've created with buildah as being almost completely useless with this LXC technique. I've used the RHEL UBI micro image before and it doesn't even have a package manager. You actually mount the container to the host and use the host's package manager to install what is needed and then unmount it to save. It makes a super slim image with as little attack surface as possible.
With buildah you can take it even farther and build a container "from scratch." So, no packages at all. Then use your package manager to install the bare minimum to get things done.
My reading of it makes it sound like a local container repo. So if you have 5 containers using nginx:latest it pulls from the template not an online repo each time.
But I could be wrong, I haven't played with PVE LXCs yet.
Yes, but then you're on that specific version of nginx. A lot of containers are built using a multi stage build process where the first stage uses a container with build tooling to build the application, then a second stage installs the result. So your end image doesn't have the build tooling and no way to update. That's intentional for security reasons. Images are meant to be immutable.
My thoughts exactly. I wonder if they'll make it easy to re-create with a newer image. The compiled app binaries are usually copied into the image via Containerfile with no way to update it from inside the container.
That one of the major reasons for why it's a tech preview, i.e., it's a bit involved.
You basically need to create separate mounpoints for the data volumes (they are logged in CT create task) and then one can create a CT from the new image and move over the data volume. Making this simpler and more approachable is on the roadmap, but no promises how fast we can deliver here.
I think it's highly recommended to do it the way you're doing it, especially for the DR aspect of it, using the builtin tools of Proxmox like replication and PBS.
I do it that way and I've had nothing but success with recovering a borked update or other problems in my containers.
12 Comments
FlexibleToast@lemmy.world · 7 pts · 268d
OCI images is very exciting. But, I don't see any way to keep them updated. You don't normally do an update on the applications inside an OCI container, you usually rebuild the container on a new image.
ikidd@lemmy.world · 4 pts · 267d
Sounds like they're used as a template and it's now a regular LXC that you can treat like a running distro.
FlexibleToast@lemmy.world · 5 pts · 267d
Right, but these containers are usually not designed to be updated like that. It totally defeats the nature of the OCI image and delivering something that has been tested to work. I'm sure there is a use case for this, but it seems more like a gimmick than a useful feature.
ikidd@lemmy.world · 1 pts · 267d
Actually, I could see myself using this for development if there were an easy way to package it back into a container image.
FlexibleToast@lemmy.world · 2 pts · 267d
Back into an OCI image? I don't know if lxc can do that, but podman can. I think it is
podman savethat allows you to save your current container as an image. Or, even better would be to use buildah. With buildah your expected workflow is to kind of run a container, run a script against that container, then save it at the end. In fact I'm specifically thinking of images I've created with buildah as being almost completely useless with this LXC technique. I've used the RHEL UBI micro image before and it doesn't even have a package manager. You actually mount the container to the host and use the host's package manager to install what is needed and then unmount it to save. It makes a super slim image with as little attack surface as possible.ikidd@lemmy.world · 1 pts · 267d
That last is interesting. I'm going to play with that some.
FlexibleToast@lemmy.world · 1 pts · 267d
With buildah you can take it even farther and build a container "from scratch." So, no packages at all. Then use your package manager to install the bare minimum to get things done.
slazer2au@lemmy.world · 2 pts · 267d
My reading of it makes it sound like a local container repo. So if you have 5 containers using nginx:latest it pulls from the template not an online repo each time.
But I could be wrong, I haven't played with PVE LXCs yet.
FlexibleToast@lemmy.world · 2 pts · 267d
Yes, but then you're on that specific version of nginx. A lot of containers are built using a multi stage build process where the first stage uses a container with build tooling to build the application, then a second stage installs the result. So your end image doesn't have the build tooling and no way to update. That's intentional for security reasons. Images are meant to be immutable.
tofu@lemmy.nocturnal.garden · 1 pts · 267d
My thoughts exactly. I wonder if they'll make it easy to re-create with a newer image. The compiled app binaries are usually copied into the image via Containerfile with no way to update it from inside the container.
Edit: it's addressed in the Proxmox board:
https://forum.proxmox.com/threads/proxmox-virtual-environment-9-1-available.176255/
possiblylinux127@lemmy.zip · 4 pts · 267d
It would be cool if they would integrate podman
umbrella@lemmy.ml · 0 pts · 267d
ikidd@lemmy.world · 2 pts · 267d
I think it's highly recommended to do it the way you're doing it, especially for the DR aspect of it, using the builtin tools of Proxmox like replication and PBS.
I do it that way and I've had nothing but success with recovering a borked update or other problems in my containers.