16:29:47 #startmeeting fedora_coreos_meeting 16:29:47 Meeting started Wed Jan 19 16:29:47 2022 UTC. 16:29:47 This meeting is logged and archived in a public location. 16:29:47 The chair is jlebon. Information about MeetBot at https://fedoraproject.org/wiki/Zodbot#Meeting_Functions. 16:29:47 Useful Commands: #action #agreed #halp #info #idea #link #topic. 16:29:47 The meeting name has been set to 'fedora_coreos_meeting' 16:29:56 #topic roll call 16:30:25 .hi aaradhak 16:30:26 aaradhak[m]: Sorry, but user 'aaradhak [m]' does not exist 16:30:52 .hello saqali 16:30:53 saqali: saqali 'Saqib Ali' 16:30:54 .hello2 16:30:56 jaimelm: jaimelm 'Jaime Magiera' 16:31:02 .hi 16:31:03 dustymabe: dustymabe 'Dusty Mabe' 16:31:04 .hello lsm540 16:31:06 .hello aaradhak 16:31:06 lsm540: Sorry, but user 'lsm540' does not exist 16:31:09 aaradhak[m]: aaradhak 'Aashish Radhakrishnan' 16:31:16 i'm lsm5 btw .. my irc id looks weird 16:31:26 #chair aaradhak[m] saqali jaimelm dustymabe lsm540 16:31:26 Current chairs: aaradhak[m] dustymabe jaimelm jlebon lsm540 saqali 16:31:26 .hi 16:31:26 .hello lsm5 16:31:26 bgilbert: bgilbert 'Benjamin Gilbert' 16:31:29 lsm540: lsm5 'Lokesh Mandvekar' 16:31:31 .hi 16:31:32 .hello baude 16:31:32 jmarrero: jmarrero 'Joseph Marrero' 16:31:35 baude: baude 'Brent Baude' 16:31:43 .hello mheon 16:31:44 mheon: mheon 'Matthew Heon' 16:31:45 .hi 16:31:46 aaradhak: aaradhak 'Aashish Radhakrishnan' 16:32:00 #chair bgilbert jmarrero baude mheon 16:32:00 Current chairs: aaradhak[m] baude bgilbert dustymabe jaimelm jlebon jmarrero lsm540 mheon saqali 16:32:03 .hi 16:32:04 .hello siosm 16:32:04 fifofonix: fifofonix 'Fifo Phonics' 16:32:07 travier: siosm 'Timothée Ravier' 16:32:09 #chair fifofonix travier 16:32:09 Current chairs: aaradhak[m] baude bgilbert dustymabe fifofonix jaimelm jlebon jmarrero lsm540 mheon saqali travier 16:32:39 lsm540: need to /nick ? 16:33:03 .hello miabbott 16:33:04 miabbott: miabbott 'Micah Abbott' 16:33:09 dunno, i'd rather keep it as-is if it's ok 16:33:15 cool ok, let's wait half a minute more 16:33:22 Hello 16:33:29 #chaiir miabbott dwalsh_ 16:33:36 off by one 16:33:38 jlebon i'm already logged in from matrix, that's causing conflicts with this session 16:33:48 .hi 16:33:48 davdunc[m: Error: Missing "]". You may want to quote your arguments with double quotes in order to prevent extra brackets from being evaluated as nested commands. 16:33:50 lsm540: ahh gotcha 16:33:53 #chair miabbott dwalsh_ 16:33:53 Current chairs: aaradhak[m] baude bgilbert dustymabe dwalsh_ fifofonix jaimelm jlebon jmarrero lsm540 mheon miabbott saqali travier 16:33:58 #chair davdunc[m 16:33:58 Current chairs: aaradhak[m] baude bgilbert davdunc[m dustymabe dwalsh_ fifofonix jaimelm jlebon jmarrero lsm540 mheon miabbott saqali travier 16:34:00 miabbott: :) 16:34:06 ok let's start! 16:34:09 #topic Action items from last meeting 16:34:15 -ENOENT 16:34:30 great! 16:34:47 /!\ Matrix users: There might be lag with the bridge so consider joining via IRC just for this meeting 16:34:49 let's move to the first labeled topic 16:35:06 #topic podman v4.0, Fedora 35 and CoreOS 16:35:10 #link https://github.com/coreos/fedora-coreos-tracker/issues/1070 16:35:19 lsm540: do you want to introduce this one? 16:35:31 i'll let mheon go 16:35:42 .hi 16:35:42 RE: breaking changes 16:35:42 ravanelli: ravanelli 'Renata Renata Andrade Matos Ravanelii' 16:35:59 I will take a stab. 16:36:06 in summary: we're about to release a new major release of podman, v4.0.0 16:36:07 go ahead dan 16:36:13 mheon, go 16:36:29 .hi 16:36:30 this release includes some breaking changes to our REST API, hence the major version bump 16:36:30 lorbus: lorbus 'Christian Glombek' 16:36:51 #chair lorbus 16:36:51 Current chairs: aaradhak[m] baude bgilbert davdunc[m dustymabe dwalsh_ fifofonix jaimelm jlebon jmarrero lorbus lsm540 mheon miabbott saqali travier 16:36:51 as such, we won't be including this in fedora 35 and older, only rawhide and eventually 36 once that lands 16:37:17 however, this introduces a problem with podman-machine, which we use for running podman on OS X, by means of an FCOS VM 16:37:36 .hi 16:37:37 lucab: lucab 'Luca BRUNO' 16:37:52 as noted, there were breaking changes in the remote API, so Podman v3.x.x cannot be used with Podman v4.x.x, either as a client or server. 16:38:13 Does anything else apart from the REST API has breaking changes? 16:38:25 OS X podman is mostly distributed via homebrew, and we have very little control of the update pace, so it will update rapidly to v4.0.0 once that releases 16:38:42 travier: no. there were extensive changes to the network stack but they should not be user-facing. 16:38:44 hmm ok. and remind me again. does podman machine hardcode a version or just brings up the latest stable and let's it auto-update? 16:38:53 We are changing the entire Network Stack. Some potential changes in command line json fields as well. 16:39:04 jlebon: we allow stream selection, but default is latest stable 16:39:07 no hardcoding afaik 16:39:16 though i'll defer to baude for technical details on machine 16:39:26 #chair lucab 16:39:26 Current chairs: aaradhak[m] baude bgilbert davdunc[m dustymabe dwalsh_ fifofonix jaimelm jlebon jmarrero lorbus lsm540 lucab mheon miabbott saqali travier 16:39:31 #chair ravanelli 16:39:31 Current chairs: aaradhak[m] baude bgilbert davdunc[m dustymabe dwalsh_ fifofonix jaimelm jlebon jmarrero lorbus lsm540 lucab mheon miabbott ravanelli saqali travier 16:39:57 Bottom line is we don't want to wait for fedora 36 to update package on Fedora CoreOS. 16:40:03 Can we ship a version that has both APIs for a while? 16:40:10 there is no hard coding, but there is an API comparison 16:40:20 travier, no 16:40:41 hmm. I see two problems here we need to consider 16:40:46 that version would still have to be "in" the fcos vm anyway 16:40:48 We will make packages available for Fedora 35 but they will not be released. So if people want them, they will have to manually download them. 16:41:01 we'd like to improve API compatibility in the future, try and prevent this situation, but with the current architecture we don't have time before v4.0 release 16:41:05 1. how do we help the podman team achieve their goals with podman-machine/FCOS 16:41:18 2. how to we handle the breaking changes when FCOS stable moves to podman 4.0 16:41:25 can coreos consume koji builds that are not in bodhi updates? 16:41:34 lsm540: we can 16:41:46 i believe we handle the breaking changes in podman itself 16:41:46 but I don't think we should 16:41:57 we'll want to consider all options and choose the best one 16:42:15 Does the docker API compat has any breaking change? that's the one most likely to be used today 16:42:29 for #2, when thhe version inside and outside are 4.x, we handle the breaking changes, upgrades, etc 16:42:39 negative, the docker API continues to support docker v1.40 16:42:53 the changes are to the podman-specific side of the API 16:43:08 and travier that also is not true ... when you call podman images on the mac, that uses the podman api ... so all cli from the mac is podman api based 16:43:09 The issue from our point of view, is MAC Users are chafing at the bit, for new version. Docker starts charging at end of January. So lots of people are looking for an improved Podman experience 16:43:29 We generally try to have a 3 months warning period for major changes in FCOS 16:43:45 fwiw, this issue isnt just for major versions, we have the same issue with .Y releases, takes weeks to sync versions 16:44:00 travier: yes, for stable.. I think `next` is there for more experimental changes 16:44:07 less serious for minor releases, since the APIs generally match 16:44:08 baude: sorry, I meant "used in FCOS" outside of the macOS use case 16:44:19 ok, yeah 16:44:21 dustymabe: yeah, that's what I was thinking too, re. `next` 16:44:21 so the question is, would we want to be able to ship podman 4.0 earlier in `next`? 16:44:37 dustymabe, that would be somewhat ideal 16:45:15 How far are we from F36 beta? 16:45:32 travier: I think branching is happening sometime soon (like next week or something) 16:45:39 let me check the date for beta 16:45:45 Beta release Tue 2022-03-15 16:45:46 BTW, this is probably not just Podman, some of the packages it relies on will get upgraded as well, although those can be released to F35 (crun, runc, slirp4netns ...) 16:45:48 beta freeze is feb 22 16:46:03 dwalsh, netavark and aardvark too 16:46:10 beta release is mar 15 16:46:17 Yup, we could release those to f35 16:46:34 We generally rebase next when the beta is released right? 16:46:50 travier: my proposal isn't to rebase next now 16:47:01 it would be to pick up a podman 4.0 built against f35 16:47:13 Sure, what we want is f35 bits with newer Podman 4.0 16:47:13 dustymabe, ++ 16:47:15 i.e. built in koji but not released to the rest of Fedora 16:47:24 Agreed 16:47:27 dustymabe that sounds great to me 16:47:44 to be clear, i'm not voting for or against it right now, just playing with the idea 16:47:47 Sure, but this is making us clearly not Fedora anymore as we would be shipping something not ever released in Fedora 16:48:10 ehh, i'm not sure it's that black/white 16:48:22 we shipped a systemd package in f34 that was never released in bodhi 16:48:31 did that make us not Fedora anymore? 16:48:32 Think of it as a Rawhide release of Podman, so it will be "released" in Fedora. 16:48:34 if podman on mac used FCOS `next` for the next couple months, it would be getting builds that haven't baked in public the way `stable` has 16:48:34 will the side podman build be fully supported? 16:48:47 jlebon, yes 16:48:49 i.e. if our users hit issues, can we count on the podman team to fix things? 16:49:01 yes 16:49:06 and then if we rebase `next` to 36 in March, it'd be getting relatively bleeding-edge stuff 16:49:12 bgilbert: I think they use `testing` today, so it's probably already true 16:49:37 The Container team will be more concentrating and fixing issues on Podman 4.0 then we will on 3.4 16:49:41 at least for the "getting builds that haven't baked in public the way `stable` has" 16:50:11 there's also walters' idea of having podman machine do an override replace 16:50:13 baude said they default to stable right now 16:50:21 travier: oh nice 16:50:35 maybe I was operating off of old information 16:51:10 > jlebon: we allow stream selection, but default is latest stable 16:51:13 We will change the default in podman 4.0 release. 16:51:18 dustymabe, travier i would need to double check .. at one point we did default to testing, and then it was just for aarch64 16:51:29 dwalsh, exactly 16:51:39 dwalsh, and then down the line, we can flip back 16:51:51 ok so let's wrangle this discussion back to proposals 16:51:53 override would also allow users to keep selecting the stream they want 16:51:55 i don't think swapping to a more recent stream is a blocker for us, it's not that difficult to swap back and forth 16:51:58 Sure once podman 4.* stablizes. 16:51:59 instead of being forced to use next 16:52:13 not sure how much they care about the actual stream used though 16:52:15 I don't think the comparison with the systemd cse stands as this is a much bigger change. I'm more in favor of override 16:52:31 jlebon: so your proposal is to have rpm-ostree override replace on first boot? 16:52:36 dwalsh, we could put a little logic in there too 16:52:50 travier: the original design for `next` had it shipping -rc kernels. I'm not too concerned about the "not Fedora" part for next 16:52:53 dustymabe, The problem with that is it is slow... 16:52:58 very slow 16:52:59 dustymabe: right yeah, it seems like the simplest releng wise. (though it's walters' proposal to be clear :) ) 16:53:18 and it delays usage of the vm, while users wonder what is going on 16:53:35 jlebon: but then we'd need a repo somewhere maintained (couldn't use fedora repos because it's not released in Fedora) 16:53:49 how about a copr ? 16:53:56 dustymabe: that shouldn't be hard to resolve 16:53:58 right something like that 16:54:13 copr would be doable for podman team 16:54:19 baking podman 4 in `next` seems like a good use of `next` IMO 16:54:33 baude: re. very slow, are you talking about the override replace approach? 16:54:41 Yeah I'm good with `next` 16:55:05 also, what's the idea with stream selection? do you expect a lot of users to select a different stream than the default? 16:56:09 bgilbert: my only minor concern is the beta rebase part of it 16:56:14 * dustymabe has to run go pick someone up - I'm +1 for using next, but will note it means podman users are going to get f36 at beta time, so better be ready for that. 16:56:19 jlebon: agreed 16:56:19 to handle situations like this, i believe - we faced something similar early on with a lack of aarch64 mainline builds 16:56:37 i.e. podman team needs to make sure they are happy with rawhide, otherwise they won't be happy with f36 16:56:47 jlebon, When we default to stable, users might want to take advantage of new features, so they would change to next. 16:57:19 dwalsh: so what the override approach provides is the stability of stable with just podman swapped out, which you control 16:57:51 it doesn't even have to be a either/or thing. i could imagine doing both (i.e. also ship in next first) 16:57:54 But with the penalty of every user everywhere has to wait for a yum update to complete, with 0 feedback. 16:58:15 jlebon: +1 for "both" 16:58:22 Could it be a rpm-ostree usroverlay and rpm -i? 16:58:52 basically they can use `next` but if something breaks in `next` they'll need to be able to handle it by selecting a different stream and doing an override 16:59:12 dwalsh: are you willing to accept a stability tradeoff to avoid that yum update? 16:59:14 dwalsh: i think we can optimize that. e.g. podman machine could only enable the single repo it needs 16:59:17 If next breaks and they have podman 4 on the host, they have no other options 16:59:38 travier: see my last comment, does that help? 16:59:44 and then `apply-live` to avoid rebooting 17:00:01 jlebon: does apply live work with override replace? 17:00:11 it does, you have to pass in a switch 17:00:19 hmm, that seems dangerous :) 17:00:43 it's been pretty good honestly :) 17:00:49 * dustymabe leaves now 17:01:07 How unstable has next been in the past. If next == Rawhide, then probably no. If next == updates-testing then probably yes. 17:01:33 We really only rely on systemd, kernel and Podman on the fcos. 17:01:34 next is testing right now, but will be f36 beta at beta release 17:01:41 next is going to be equal to f36 beta in 2 months 17:01:45 that's about as unstable as it gets 17:03:17 ok so, a few options here so far: 17:03:18 i suppose a one off with f35 and podman4 is out of question 17:03:53 1. ship v4 in next now 17:04:05 2. ship v4 in a repo, and have podman machine do an override 17:04:12 3. do both of those things 17:04:40 (Maybe we should write a Fedora 36 change too for all of that. But the deadline is just passed.) 17:04:49 baude: and not update? 17:05:00 and then update when things sync up 17:05:15 side FCOS builds doesn't sound great 17:05:24 baude: => 3+ months without security updates 17:05:41 I'd prefer we ship in next instead of something custom 17:06:12 baude: do you want to investigate the override approach? we can help out to see how to optimize it 17:06:16 We can ship in next and then have until march 15 to figure out what to do... 17:06:25 dwalsh: true 17:06:55 yup, that sounds ok with me too 17:07:12 How bad was it when f35 branched. Were there kernel and systemd issues? 17:07:16 the next scheduled FCOS release is Feb 1 17:07:39 jlebon, i would like to know more about that regardless of this issue 17:08:16 dwalsh: i don't recall too well tbh, but I don't think we had anything major break 17:08:48 Fedora releases are getting more stable so I don't remember anything major breaking with the latest beta 17:09:02 There was a btrfs bug but we don't use that 17:09:16 baude: ack sounds good 17:09:28 ok, let me try a proposal 17:10:00 The override approach as several benefits: We can actually test it in CI, you can ship whatever podman you want on all streams. 17:10:19 #proposed we will ship podman v4 based on f35 in next for now and meanwhile investigate other approaches before the beta rebase 17:10:34 seems reasonable 17:10:53 it sounds as though they'd like podman 4 in the image before Feb 1 though 17:11:02 s/in the image/available/ 17:11:09 is that so? 17:11:49 my expected final release date was the 1st exactly, assuming no slips 17:11:50 No Podman 4 is only rc1. 17:12:08 ok cool 17:12:21 in that case, we'll need to coordinate if we want to catch that week's release 17:12:24 yup 17:12:44 in a pinch, maybe we could do a one-off build and then you could switch back to `next` after the following release? 17:13:31 if the schedules badly misalign 17:13:35 we could also do an ad-hoc next release but not roll it out 17:13:52 jlebon: it'd still affect new launches though, fwiw 17:14:02 oh, you mean not update stream metadata 17:14:26 at least the release index would still need updating though 17:14:30 anyway, circling back 17:14:38 acks for the proposal above? 17:14:50 +1 17:14:55 +1 17:15:01 +1 17:15:12 I give my vote 17:15:42 ok, i'll assume dwalsh is +1 since he suggested it :) 17:15:46 #agreed we will ship podman v4 based on f35 in next for now and meanwhile investigate other approaches before the beta rebase 17:15:47 +1 from me too 17:16:14 cool. anything else to discuss on this topic today? 17:16:16 good discussion, thanks all 17:16:25 Podman 4 or 4 rc1 . 17:16:27 ? 17:16:52 nemric: 4 ideally :) 17:17:00 right 17:17:10 ok, let's move on to the next topic 17:17:17 thanks podman team for joining! 17:17:18 thanks all 17:17:31 #topic Certificate expired for https://updates.coreos.fedoraproject.org 17:17:34 #link https://github.com/coreos/fedora-coreos-tracker/issues/1072 17:17:34 thanks for all the info! 17:17:51 bgilbert: you tagged this. want to take it? 17:18:10 I don't know more than what I've read, but sure 17:18:11 I think this is to raise awareness 17:18:39 the TLS cert expired for the production Cincinnati update server 17:18:43 there is movement going on on -infra 17:19:05 it should be fixed now, but AIUI there are other staging certs etc. which are still being fixed 17:19:20 jlebon, dustymabe thanks for the consideration 17:19:24 ok cool. wasn't sure if it was more than just for awareness 17:19:55 jlebon: also I'll second what you said in the ticket that we should RCA this 17:19:58 baude: of course! and feel free to discuss in #fedora-coreos re. the other approaches 17:20:15 bgilbert: My grafana don't show me cert warnings anymore.... 17:20:36 It should be fixed 17:20:39 ok cool. so let's all stay tuned for developments. 17:20:44 it still isn't completely fixed 17:21:04 travier: do you think we have time for https://github.com/coreos/fedora-coreos-tracker/issues/1062 or should we do it next week? 17:21:26 jlebon: next week will be good 17:21:57 ok cool. there's a few other meaty tickets, but I don't think we have enough time 17:22:17 so i'd suggest we go to open floor unless someone has an topic they want to bring up 17:22:20 a* 17:22:21 jlebon: still working on the kernel bug. 17:22:34 observation: impressive how the rollback worked seamlessly last week (i think that was last week). thanks. 17:22:45 davdunc: ack, thanks for the update 17:23:21 fifofonix: cool :) 17:23:21 fifofonix: +1 17:23:25 #topic Open Floor 17:23:49 fifofonix: a local rollback or the stream tweak? 17:23:57 the stream 'tweak'. 17:25:06 it's cool when we get to exercise the flexibility we have with the release process 17:25:07 ack (sorry just making sure there was no unintended rollback) 17:25:50 99% of the time it's always the same thing (release rollouts), but that 1% is fun 17:26:28 it is good to test these things once in a while! local rollbacks also awesome (used once before, forget why). 17:26:53 +1 sweet 17:27:03 hopefully one day we'll get around to automatic rollback :) 17:27:37 ok, closing the meeting in 60s unless anyone has anything else 17:28:30 I have to learn git more deeply :D but that's my own personal bug 17:28:37 #endmeeting