16:30:19 #startmeeting fedora_coreos_meeting 16:30:19 Meeting started Wed Dec 12 16:30:19 2018 UTC. 16:30:19 This meeting is logged and archived in a public location. 16:30:19 The chair is dustymabe. Information about MeetBot at http://wiki.debian.org/MeetBot. 16:30:19 Useful Commands: #action #agreed #halp #info #idea #link #topic. 16:30:19 The meeting name has been set to 'fedora_coreos_meeting' 16:30:24 #topic roll call 16:30:33 .hello2 16:30:34 dustymabe: dustymabe 'Dusty Mabe' 16:30:35 .hello2 16:30:37 yzhang: yzhang 'Yu Qi Zhang' 16:30:38 .hello rfairleyredhat 16:30:40 rfairley: rfairleyredhat 'Robert Fairley' 16:30:40 .hello2 16:30:43 jlebon: jlebon 'None' 16:30:58 .hello2 16:30:59 miabbott: miabbott 'Micah Abbott' 16:31:13 .hello2 16:31:14 rishi: rishi 'Debarshi Ray' 16:31:16 .fas jasonbrooks 16:31:21 jbrooks: jasonbrooks 'Jason Brooks' 16:31:49 .hello2 16:31:50 slowrie: slowrie 'Stephen Lowrie' 16:32:24 walters: are you around today or do you still have a conflict ? 16:32:41 #chair yzhang rfairley jlebon miabbott rishi jbrooks slowrie 16:32:41 Current chairs: dustymabe jbrooks jlebon miabbott rfairley rishi slowrie yzhang 16:32:50 .hello2 16:32:51 walters: walters 'Colin Walters' 16:33:05 dustymabe: i can be around for about 10 minutes before i need to drive to 🥋 16:33:34 walters: +1 16:33:43 .hello mnguyen 16:33:44 will try to get to that topic early 16:33:44 mnguyen_: mnguyen 'Michael Nguyen' 16:33:59 so we'll do this a bit out of order since walters has to leave soon 16:34:06 #chair walters mnguyen_ 16:34:06 Current chairs: dustymabe jbrooks jlebon miabbott mnguyen_ rfairley rishi slowrie walters yzhang 16:34:27 will do action items from last meeting here in just a minute 16:34:34 first.. 16:34:42 #topic where should rpm-ostree project live 16:34:52 #link https://github.com/coreos/fedora-coreos-tracker/issues/19 16:35:09 we discussed this last meeting a bit (after walters had left) 16:35:32 would be interested to get your input on $topic since walters invented rpm-ostree 16:35:34 .hello2 16:35:35 lorbus_: Sorry, but you don't exist 16:35:40 .hello lorbus 16:35:41 lorbus_: lorbus 'Christian Glombek' 16:35:56 .hello sayanchowdhury 16:35:57 sayan: sayanchowdhury 'Sayan Chowdhury' 16:36:09 I think the current proposals are either 'move to ostreedev org' or 'move to rpm-software-management' org 16:37:05 i commented in the issue 16:38:15 walters: thanks! jlebon - would you like to ask rpm-software-management to see what they say? 16:38:28 yup, sure 16:38:31 thanks! 16:38:44 +1 walters 16:38:51 #action jlebon to ask rpm-software-management org on github about name move of rpm-ostree repo 16:39:09 ok we'll move to action items from last meeting now 16:39:23 #topic Action items from last meeting 16:39:35 * jbrooks to create a ticket for deciding on the mechanism for shipping 16:39:37 kube/okd pieces 16:39:39 * bgilbert to review https://github.com/coreos/mantle/pull/954 16:39:41 * bgilbert, dustymabe, ashcrow, walters, slowrie to discuss 16:39:43 maintenance/review structure for mantle 16:39:45 * lorbus to convert and bring up to speed the container-best-practices 16:39:47 repo 16:39:48 dustymabe, I did this one https://github.com/coreos/fedora-coreos-tracker/issues/93 16:40:12 #info jbrooks created ticket for discussing machanism for shipping OKD/kube #93 16:40:18 #link https://github.com/coreos/fedora-coreos-tracker/issues/93 16:40:31 https://docs.fedoraproject.org/en-US/containers/ is up already 16:40:54 #info lorbus_ converted container-best-practices repo and the website is already up 16:41:00 #link https://docs.fedoraproject.org/en-US/containers/ 16:41:07 do we have bgilbert today ? 16:41:21 doesn't look like it 16:41:29 I created the structure and started copying over info from best-practices and the Container SIG guidelines, but the content is really raw and definitely WIP 16:41:50 #link https://docs.fedoraproject.org/en-US/containers/ 16:42:19 if you can, please contribute to the docs by reviewing or writing sections! 16:42:30 I believe bgilbert was going to work on a new PR to address the mantle PR 16:42:59 #action bgilbert to get functionality requested in https://github.com/coreos/mantle/pull/954 into mantle code base 16:43:50 final action item - I know I had a conversation with bgilbert around admin of the mantle codebase but we didn't have a coordinated effort so we might need to re-action 16:44:15 #action bgilbert, dustymabe, ashcrow, walters, slowrie to discuss maintenance/review structure for mantle 16:44:26 ok moving on to meeting tickets ? 16:44:40 well first. one side topic 16:44:52 .hello bgilbert 16:44:53 bgilbert[1]: bgilbert 'Benjamin Gilbert' 16:44:54 * dustymabe waves at bgilbert[1] 16:45:03 #chair bgilbert[1] bgilbert 16:45:03 Current chairs: bgilbert bgilbert[1] dustymabe jbrooks jlebon miabbott mnguyen_ rfairley rishi slowrie walters yzhang 16:45:26 bgilbert[1]: I re-actioned this item from last meeting: `bgilbert, dustymabe, ashcrow, walters, slowrie to discuss maintenance/review structure for mantle` 16:45:49 I know we had some side conversations but I don't know if we need a more coordinated effort 16:46:34 ok moving on to next topic 16:47:00 #topic high/medium/low priority work items/isues for Fedora CoreOS first release 16:47:09 yeah, the mantle thing is in process 16:47:35 So I have started to look at slotting our necessary work for Fedora CoreOS in fedora 30 into weekly/monthly goals 16:47:50 This morning I came up with a few new items. 16:48:01 dustymabe: nice 16:48:10 I'd like to ask everyone to take a look at the ones we currently have now and see if anything is missing 16:48:22 or if there are tickets that exist already that need to be added to a priority label 16:48:43 .hello sinnykumari 16:48:44 ksinny: sinnykumari 'Sinny Kumari' 16:48:51 #info please everyone take a look at high/medium priority tickets and identify missing items 16:49:03 #link https://github.com/coreos/fedora-coreos-tracker/issues?q=is%3Aissue+is%3Aopen+label%3Apriority%2Fmedium 16:49:08 #link https://github.com/coreos/fedora-coreos-tracker/issues?q=is%3Aissue+is%3Aopen+label%3Apriority%2Fhigh 16:50:06 #action dustymabe to make timeline for Fedora CoreOS work and share it with the community on the tracker 16:50:36 I guess this was mostly an FYI unless anyone has any comments 16:51:24 dustymabe++ 16:51:32 #topic discuss merge of fedora-toolbox and coreos-toolbox efforts 16:51:41 #link https://github.com/coreos/fedora-coreos-tracker/issues/90 16:52:39 * rishi looks up 16:53:28 So, from my notes for the existing implementations, it seems that the toolbox's have different flags/mountpoints, base images, build process and sudo/non-sudo needs 16:53:51 I feel like if we do end up merging the two, the "easiest" way seems to be just squashing the two together 16:54:11 i.e. in fedora-toolbox, detect if we're on a *cos system, and if we are, switch to "debug mode" 16:54:19 (run every command slightly differently) 16:54:32 yzhang: Yes, that's fine by me. 16:54:38 which... seems kinda ugly but is do-able 16:54:45 yzhang: what is "debug mode" 16:54:54 i.e. debug vs dev ? 16:54:54 actually on that note, what would be the use case for fcos? 16:55:12 I'd have probably done something myself, but the specific use-cases for CoreOS aren't well known to me. 16:55:31 do I understand correctly that the question is the toolboxes of CL vs. Fedora*, not Fedora vs. *COS? 16:55:33 dustymabe: yeah, so sudo, mount root, have debug image by default (for rhcos it would be from openshift registry with sosreport etc. built in) 16:56:08 bgilbert[1]: we did do a port from CL->RHCOS, so I think this discussion is Silverblue vs. FCOS vs. RHCOS 16:56:25 ah, okay 16:56:27 ok let's bucket these things slightly 16:56:32 the port being: https://github.com/coreos/toolbox/blob/master/rhcos-toolbox 16:56:45 let's start with Fedora Classic vs Silverblue vs FCOS vs RHCOS 16:56:48 and the silverblue one being: https://github.com/debarshiray/fedora-toolbox 16:56:55 Sure 16:57:04 so I think we can simplify slightly 16:57:35 Desktop (Fedora Classic + Silverblue) & Server (FCOS, RHCOS) 16:58:02 Would that be summarizable as "dev" vs. "debug"? 16:58:15 There is a Fedora Server and Cloud edition so maybe we bucket those into the 2nd bucket 16:58:31 yzhang: i think so yes.. let me progressively get there 16:58:38 though we should still allow for the opposite use case on each (e.g. "debug" on Silverblue) 16:58:56 so Desktop (Fedora Workstation + Silverblue) vs Server (Fedora Server, Fedora Cloud, FCOS, RHCOS) 16:59:30 *nod* 16:59:33 so now I think we can simplify into Development (Desktop) vs Debug (Server) 16:59:34 * wa1em lurks 17:00:06 and I think a proposed simplification we had made was to make Development triggered by non-root user and Debug triggered by root user 17:00:34 so that we don't have "detect FCOS, do something special", but rather "detect user, do 1 of two things" 17:00:38 that seems... really non-intuitive 17:00:42 dustymabe: Yes, that seemed sensible to me. 17:00:58 bgilbert[1]: triggering off of user ? 17:01:01 dustymabe: yeah 17:01:12 most commands don't behave substantially differently when run root vs. non-root 17:01:14 bgilbert[1]: what if the tool tells you what it's doing based on your user ? 17:01:22 Although, regarding jlebon 's point, is there anything that would prevent the CoreOS toolbox from running with root on a Silverblue system? 17:01:26 or, make it a switch, but just default to a different one on Desktop vs Server 17:01:27 i.e. detected root user, assuming debug mode 17:01:41 dustymabe: doesn't help scripts etc. why not just have a cmdline flag? 17:02:01 bgilbert[1]: we could do that too, but the "detection" could aid and assume the cmdline flag 17:02:03 The other thing is, I'd assume the user running toolbox in rhcos would be "core" 17:02:14 jlebon: changing the default will confuse people who use both :-( 17:02:17 yzhang: why not root ? 17:02:18 bgilbert[1]: The command line flag when specified could override the auto-detection. 17:02:33 That would help keep scripts predictable, but still aid with typing. 17:02:34 rishi: right 17:03:00 alternatively, two entrypoints which are just symlinks and key off of $0 17:03:12 dustymabe: the default user you ssh with is "core", I assume it may confuse some admins if they ran that and then it failed since the dev mode doesn't work very well on rhcos 17:03:14 to make it really explicit 17:03:21 jlebon: Yeah, or that. 17:03:22 (but still convenient) 17:03:26 yzhang: sudo toolbox ?? 17:03:29 you would be root 17:03:32 jlebon: works for me 17:03:48 jlebon: That might touch upon the renaming discussion: https://github.com/debarshiray/fedora-toolbox/issues/8 17:04:31 dustymabe: sure I suppose we can document that 17:04:58 .hello2 17:04:59 ajeddeloh: ajeddeloh 'Andrew Jeddeloh' 17:05:19 bgilbert[1]: so you don't think it would be a good idea to switch mode based on user (but with a nice message explaining that) ? 17:05:27 dustymabe: alternatively we can add a warning or something that says if you're on a rhcos system and not sudo'ing, you shouldn't be? 17:05:35 part of the point of toolbox is to be able to easily type something and get a sane environment 17:05:55 dustymabe: I think we'd regret it. 17:05:58 I think a flag would potentially make more sense, just would be slightly harder to use for someone who has never used a rhcos system and wants to see whats wrong 17:06:01 nice messages are another thing to read / put on the screen 17:06:17 and people who need to deal with muscle memory on both platforms will just end up always passing the flag 17:06:41 ok so we need to decide which one is the default then ? 17:06:48 or we require the user to pass in an option 17:07:26 default to debug, require developers to pass a flag? 17:07:36 not sure if I agree with that 17:07:43 we probably need to think about who would be using it more 17:07:44 set default based on OS type, and override with flag? 17:07:55 Question. If we choose the default to be "debug", then would it always be possible to run in "debug" mode as non-root? 17:07:57 I'd argue developers would be using it more 17:08:09 but I don't know 17:08:42 I don't know either. There's a vague plan to default the Silverblue Terminal to the toolbox. 17:08:42 rishi: good question, for rhcos systems that would be a requirement 17:09:00 yzhang: what would be a requirement? root ? 17:09:05 yes 17:09:21 yzhang: You mean "debug" toolbox should work without root? Right? 17:09:46 rishi: I was thinking that "debug" toolbox would grant root if invoked from non-root user 17:10:02 alternatively, just block debug mode to sudo? 17:10:23 yeah - we could say --debug (error if not root) 17:10:37 --debug --force, (are you sure you know what you're doing? OK..) 17:11:04 Yeah. 17:11:18 well. maybe --mode=debug (since debug is a normal argument and people might have expectations there) 17:11:54 yzhang: "would grant root if invoked from non-root" ? You mean the toolbox would ask for root credentials and escalate to a real/host root shell? 17:12:25 rishi: yes, so basically the rhcos-toolbox just does everything with "sudo" anyways 17:12:50 so it doesn't check if you're root or not, we assume that on a rhcos system all users should have admin privs 17:13:00 (since normally you wouldn't be ssh'ing in anyways) 17:13:34 Otherwise, if you are not root, you get prompted at every step? :) 17:13:39 yzhang: my personal preference on that is that it wouldn't try to sudo for us, but rather give us a message telling us to run as root 17:13:47 Ok, so to back it up a bit, we're ok with splitting the toolbox into two modes of operations, "debug" and "dev", which may end up having completely different workflows, one major point of discussion now is what to use as default? 17:13:48 dustymabe: yes that 17:13:59 dustymabe: yeah we can move to that as well 17:14:06 I'm ok either way 17:14:13 Better to error out earlier than block at a prompt where the user might ctrl+c or something. 17:14:32 rishi: +1 17:14:46 The only thing I would caution against, from a RHCOS (and maybe FCOS) perspective, is to have too many flags for the user to have to set before using 17:14:48 The "oh shit" moment where you ran the wrong toolbox and ended up with some weird inconsistent state. 17:15:05 as... that was one of the reqs from ben I think 17:15:19 rishi: alternative, have a cleanup section that nukes everything ;) 17:15:20 yzhang: i agree - i thought the "detect user" bit might be useful there 17:15:56 so we have come clear options 17:16:14 i'll write this up - but one thing I wanted to come back to was this statement from earlier 17:16:40 yzhang | So, from my notes for the existing implementations, it seems that the toolbox's have different flags/mountpoints, base images, build process and sudo/non-sudo needs 17:17:08 could we consolidate flags/mountpoints, make base images configurable, and unify build process ? 17:17:20 we've obviously already been talking about sudo/non-sudo needs 17:17:25 to elaborate a bit more 17:18:01 "build process" I meant by the fedora-toolbox building images on the fly, whereas the rhcos-toolbox wants to use an existing rhel image from openshift registry 17:18:24 [ The Silverblue toolbox already has some flags to change images and containers. (there's also a --sudo flag, which probably doesn't do what CoreOS needs) ] 17:18:40 making base images configurable is an option but slightly harder to do on rhcos systems 17:18:58 the existing fedora-toolbox has some flags that is intended to work with dev envrionements 17:19:01 but errors in rhcos 17:19:04 last time I tried 17:19:12 yzhang: "the fedora-toolbox building images on the fly" -- you mean the current behaviour of 'fedora-toolbox create' ? 17:19:32 regarding configurable base images - let's just make it configurable via config file in /etc/ (i.e. you can change the default) and via CLI arg ? 17:19:45 and as for mount points... one option is to have defaults and allow user overrides, but we also cautioned against that when doing the port (I forget where the discussion was) 17:19:57 rishi: yes 17:20:15 but we can probably split that into "image-build" and "container-create" or something like that if you're ok with it 17:20:29 so it's not a major issue, we just likely wouldn't use it in rhcos 17:21:03 let's chat less about *cos vs Silverblue and more debug vs dev 17:21:06 yzhang: Ok. So what 'fedora-toolbox create' does with buildah is tied to Silverblue's objective of blurring the boundary between the host and container. 17:21:15 dustymabe: Ok. 17:21:16 :) 17:21:19 right sorry :D 17:21:28 s/rhcos/dev/g 17:21:30 don't be sorry. i'm just trying to get us to think in those terms 17:21:32 debug* 17:21:33 ah 17:21:41 yzhang-- 17:21:50 So, it takes some OCI image and does some minor customization to suit the user's environment. Things like creating a UID matching $USER and $UID, etc.. 17:22:05 so when fedora-toolbox runs today, will it default to pulling an image from a registry, or building an image locally ? 17:22:15 But that's a light tweak on top of the fedora-toolbox image. 17:22:32 dustymabe: Pulling registry.fp.o:fedora-toolbox. 17:22:39 right, and debug may need to use a different base image 17:22:42 depending on the system 17:22:48 yzhang: correct 17:22:55 yzhang: dustymabe : So, yes, about the base image. 17:23:09 so let me see if there is one possible solution 17:23:28 I think we can strip the fedora-toolbox image to be a small subset common to both and then do fedora-toolbox-coreos, fedora-toolbox-silverblue, etc.? 17:23:33 Or dev, debug? 17:23:45 there exists and ini file in /etc/ [config.development] [config.debug] where you can override settings for each mode 17:23:57 base image, mountpoints etc.. 17:24:28 the idea here being.. the user can apply some coniguration and get exactly the `toolbox` command he/she needs 17:24:47 *nod* 17:24:53 for fcos and rhcos we can customize these settings for our users 17:24:58 right 17:25:32 we could even make the 'mode' default to development or debug 17:25:40 if we wanted 17:25:44 dustymabe: Shouldn't the config have defaults for both modes on all systems? eg., if someone runs the debug mode on Silverblue? 17:25:52 rishi: it should 17:25:58 As in base images, etc.. 17:25:58 ok 17:26:04 basically 99% of settings are the same on all systems 17:26:13 *nod* 17:26:17 but there may be some settings a distributor chooses to override 17:26:27 or a user chooses to override themselves 17:26:33 so to summarize, a lot of customizable configs that should also hopefully work out of the box based on defaults 17:26:43 So /etc/toolbox.d/ ! 17:26:57 yzhang: right 17:27:00 more or less this allows us to get what each party needs but to re-use the same codebase, which should be better for us in the long run 17:27:12 rishi: yes, a dropin config file structure would be ideal IMHO 17:27:26 We are definitely making this a lot more complex :p 17:27:35 Not that its a bad thing 17:27:50 It might soon outgrow being a shell script. 17:28:07 yzhang: yeah. I think there is a lot of value in combining efforts though. 17:28:15 Agreed 17:28:20 and having coreos-toolbox and fedora-toolbox just be `toolbox` 17:28:29 Anyway, sorry for hijacking a large portion of this meeting 17:28:32 and people don't have to get confused 17:28:51 dustymabe: yzhang : One quick thing that we were discussing in Silverblue the other day. Not sure if that's relevant for CoreOS ... 17:29:11 Our pitch is that the toolbox lets you hack on OSTree based Fedoras. 17:29:13 #action dustymabe to summarize discussion of toolboxen in #90 17:29:26 Except, once inside the container, you can't really use podman. 17:29:41 I can't really speak very much for FCOS use case 17:29:49 So we were considering a bridge that would let you forward such commands to the host. 17:30:00 But for RHCOS that would likely be out of the scope 17:30:07 Like you can do from Flatpak containers. "host command" 17:30:14 rishi: let's pick up that question in #fedora-coreos right after the meeting 17:30:22 dustymabe: ok 17:30:25 #topic open floor 17:30:29 sorry we are running long 17:30:33 anyone have anything for open floor ? 17:30:40 Not me. 17:30:42 :) 17:31:12 #info we have outlined a strategy for bare metal installer and deliverable artifacts for FCOS in https://github.com/coreos/fedora-coreos-tracker/issues/91 17:31:33 will try to make progress on proofing those points out in the coming weeks 17:32:24 ok closing out meeting unless someone had something else for open floor 17:32:47 #endmeeting