feat: podman kubedock enhancement

[eye0fra]

Summary

This PR introduces significant enhancements to the Podman/Kubedock integration within the UBI9 base image, focusing on improved compatibility, usability, and automation for containerized workflows that rely on Podman, especially in environments where Kubedock is enabled.

---

Key Changes

1. Podman Wrapper System Overhaul

• New Wrapper Scripts:

  • podman-compose-down-wrapper.sh:
    Provides a robust replacement for podman compose down (or docker compose down) to ensure proper cleanup of containers/services, especially when running with Kubedock where standard compose down cannot directly shut down pods.

  • podman-interactive-wrapper.sh:
    Transparently intercepts problematic podman run -it ... invocations and replaces them with a workaround using podman exec, ensuring interactive sessions work reliably with Kubedock.
    The wrapper forcibly replaces any --user or -u options with the current user's numeric UID (via id -u), ensuring the container always runs as the invoking OpenShift user id, regardless of what is passed on the command line.

  • docker.sh:
    Emulates the Docker CLI using Podman, with logic to route commands through the appropriate wrapper when Kubedock is enabled.

• Enhanced podman-wrapper.sh:

  • Detects and delegates compose down and interactive run commands to the new specialized wrappers.
  • Ensures seamless user experience and compatibility with both standard Podman and Kubedock-enabled environments.

2. Dockerfile Updates

• Registers all new wrapper scripts in the image and sets up the environment variables for the Podman wrapper system.
• Ensures the Docker CLI emulation is available at /usr/bin/docker and all wrappers are properly installed and owned.

3. Kubedock Setup Improvements

• kubedock_setup.sh now:
  • Implements a retry loop to ensure kubeconfig permissions are set correctly
  • Dynamically constructs KUBEDOCK_PARAMS based on available environment variables (REQUEST_CPU, REQUEST_MEMORY, REAPER_KEEPMAX), allowing for more flexible resource and lifecycle management.

Testing

• Manual and automated tests performed for:
  • Interactive container sessions (podman run -it ...)
  • Compose up/down workflows
  • Kubedock-enabled and standard Podman environments
  • Permission handling for kubeconfig

---

Backward Compatibility

• All changes are additive and maintain compatibility with existing workflows.
• The wrappers only activate when Kubedock is enabled or when specific command patterns are detected.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: eye0fra

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rohanKanojia]

I’m not entirely sure, but could there be a case where the kubeconfig file is still missing after all retry attempts? If so, should we consider explicitly throwing an error or logging a warning at that point, rather than continuing silently?

[rohanKanojia]

Suggested change

#echo exec oc cp "${OPTIONS[@]}" "$OC_SRC" "$OC_DEST"

[rohanKanojia]

this list has some options listed twice e.g., --log-opt, --label, --tmpfs, --device

[rohanKanojia]

Suggested change

	# Print the command for debug
	# echo podman run -d "${FINAL_RUN_OPTS[@]}" "$IMAGE" tail -f /dev/null

[rohanKanojia]

I created a DevWorkspace to test this image. I tried various podman commands mentioned in this guide and was able to run most of them https://eclipse.dev/che/docs/stable/end-user-guide/running-containers-with-kubedock/

However, When I tried to test podman cp, I was getting this error:

docker-compose-sample $ vi hello.txt
docker-compose-sample $ podman cp hello.txt my-test:/tmp/
/home/user/.local/bin/podman: line 33: /usr/bin/podman-cp-wrapper.sh: Permission denied

When listing all scripts in /usr/bin I see that only podman-cp-wrapper.sh doesn't have executable permissions:

docker-compose-sample $ ls -lt /usr/bin| grep podman
-rwxrwxr-x. 1 root root     3340 Jul 10 16:19 podman-compose-down-wrapper.sh
-rw-rw-r--. 1 root root     1421 Jul 10 16:19 podman-cp-wrapper.sh
-rwxrwxr-x. 1 root root     4950 Jul 10 16:19 podman-interactive-wrapper.sh
-rwxrwxr-x. 1 root root     1841 Jul 10 16:19 podman.wrapper
-rwxr-xr-x. 1 root root 52475488 Jun 25 10:45 podman.orig
lrwxrwxrwx. 1 root root        6 Jun 25 10:45 podmansh -> podman