MLCubes and Podman

Hi @fed500.

We don't normally like for users to edit files under /usr/bin if avoidable. It looks like there is a package called podman-docker that will take care of setting up the docker → podman redirection (though it does it with a shell script rather than a symlink). Does MLCube work if you add podman-docker to your install list instead of creating the symlink?

As for SELinux, we would really like to see that left enabled if possible as well. I see that someone has reported that this might be as simple as adding :z to some volume mounts.

https://github.com/mlcommons/mlcube/issues/205

Is a patch for SELinux something that could be implemented before this article is published?

Thanks.

@glb Thanks for the feed back. An updated draft is available in Wordpress which:
- modifies the configuration script to use podman command
- gives permissions to the folder directly to enable writing
There is a nice post that discusses volume labels, https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/ , but this presentation introduces Udica which maybe more useful since one may want customized access policies for each container. This is probably a different article.

It may also be helpful to indicate the commit in the repository that is being used as a way of getting community feedback on what they would find useful to have in future releases - a one size fits all approach does not work in production settings, so making adaptation easy and intuitive to have good data hygiene would be good.

Hi Benson.

I just made a quick review of your article and I feel like it is now spending too much time on SELinux for the size of the article. I think it would be better to reduce all of that to just the following two lines and then refer the user to a slightly more authoritative resource for an explanation of SELinux and Containers (i.e. https://opensource.com/article/18/2/selinux-labels-container-runtimes).

$ sudo semanage fcontext -a -t container_file_t "$PWD/workspace(/.*)?"
$ sudo restorecon -Rv $PWD/workspace

Note that in the above example, I explicitly set the desired SELinux type label rather than copying one from another file system location. I think being explicit about what is being changed and how it is being changed is better than having the user just copy whatever happens to be set on some other part of the file system. Also, -F should not be necessary on restorecon in this case since only the type label is being changed.

This is just my opinion. You could certainly write a more thorough explanation of SELinux and how it works with containers. But if you want to do that, I'd rather see that written as a separate article, published before this one, and then referenced in this article rather than intermixing the two subject matters in the one article.

Thanks.

Thanks for the reference and the suggestions. Will update the article
accordingly. Probably a further article on Udica would be helpful at
some point, but this would take some time, and maybe raising the issue
here is helpful to encourage further discussions in these projects. Note
that the correct full label is system_u:object_r:container_file_t:s0
not unconfined_u:object_r:container_file_t:s0 so would need to use

$ sudo semanage fcontext -a -s system_u -t container_file_t 
"$PWD/workspace(/.*)?"
$ sudo restorecon -Rv $PWD/workspace

or

$ sudo semanage fcontext -m -s system_u -t container_file_t 
"$PWD/workspace(/.*)?"
$ sudo restorecon -RFv $PWD/workspace

but will test and update accordingly.

Updated the article in Wordpress. Steps only work on x86_64 because the container at https://hub.docker.com/r/mlcommons/hello_world/tags is built for AMD64. restorecon -RFv requires the F flag to be able to change the user label to system_u

Thanks for your suggestions. Made further updates. It should now work on Arm. It seems system_u tag is not necessary. Let me know if any further suggestions.

Hey fed500. Your cover image, in principle, is fine. But the dimensions need to be 1890x800 px and it needs to be in jpg format. Also, the main text of the image should be centered so as not to be clipped when the image is rendered on some third-party feed readers.

Thanks.

Thanks for the feedback. Updated the image.

Hi Benson.

I've made a pass at editing your article for publication. Mostly I just tweaked the formatting to use preformatted blocks or the "keyboard input" typeset instead of "code" blocks so that things render properly with the Fedora Magazine theme. I also reworded the excerpt a little bit to provide a short definition of what MLCube is.

You can still make small revisions if you need. Otherwise, if you are OK with this, it will go out tomorrow at 08:00 UTC.

Thanks!

Thanks. Made a few changes to improve readability.

LGTM. I've scheduled this to go out at 08:00 UTC 2022-04-18.

Thanks!