Rhel9 - #189
Closed
dGilli wants to merge 336 commits into
Closed
Conversation
…rver, add basic lib deps for most appimages
…, decisions ADR (F31-F35/F40/F41), state flip
…ings F42-F45, NRP recipe reference, progress refresh
…12-pkg delta, XDG_RUNTIME_DIR), exact startwm.sh code, watchdog match proof
… chown, nautilus flag, dbus socket), autonomous QA all pass + edge 4/4
… — task 2 Image dgilli/baseimage-selkies:rhel9-p1-gnome (f54738a5b9d4), 5 build cycles. Revert point: tag pre-gnome-desktop -> b4c199f. - Dockerfile.rhel9: +12 GNOME packages (AppStream, F42/F43/F47): gnome-shell 40.10 + mutter + gnome-session set + gnome-settings-daemon + nautilus 40.2 + gnome-terminal + gedit + gnome-calculator + gnome-screenshot + firefox 140 ESR + glx-utils (glxinfo for the GLX-ready wait). xsetroot and dbus-run-session were already present (F46) - root/defaults/startwm.sh: 5th distro-aware no-op branch — direct gnome-shell launch (NRP-proven pattern F44: --x11 --sm-disable, no gnome-session, which bypasses welcome screen/keyring/logind/lock); deterministic session bus via explicit dbus-daemon --address (F51: EL9 dbus-run-session drops a random /tmp socket other apps cannot discover); per-boot XDG_RUNTIME_DIR= /tmp/runtime-abc (F48: /config/.XDG is on the persistent volume); no auto-apps (user decision 2026-08-28 — clean desktop, apps via GNOME app grid). DESKTOP=openbox keeps the full openbox + autostart + RESTART_APP contract (svc-watchdog pgreps the sh process) - init-selkies-config/run: +6 lines — chown /config/.cache to abc (F49: the base init-mods pip hook leaves it root-owned, which breaks GNOME app caches); its TERMINAL_NAMES list already covers gnome-terminal for DISABLE_TERMINALS hardening - package_versions_rhel9.txt: regenerated (24 epel / 414 rhel9 / 220 ubi9-base + 40 python; EPEL key virtual pkg excluded by convention) - findings F42-F51 in memory-bank/findings.md (separate MB commits)
…task doc, ADR, findings F42-F51, state COMPLETE
…tings at boot Image dgilli/baseimage-selkies:rhel9-p1-gnome (99da8c1475f5), cycles 6-7. - root/usr/share/backgrounds/slu-rhel.jpg: user-provided SLU/RHEL wallpaper (1920x1080 JPEG; moved from repo-root SLU-RHEL.jpg) - root/defaults/startwm.sh: gnome branch sets org.gnome.desktop.background picture-uri/-dark + picture-options=spanned once the session bus is up; gsettings writes land in the dconf user DB under /config and are re-applied idempotently every boot (F52: RHEL9 enum is "spanned", not Fedora's "span" — c6's "span" was silently rejected, leaving default zoom) - fixed stale dbus-socket comment (auto-apps were removed earlier)
…ned), task doc/README/progress/activeContext updates, ops-log
… c4->c7, ADR consequences/refs, toc ranges, task doc outcome/files/cycle table)
…AsNonRoot — rootful image drops in as-is; verified in NRP repo + docs, MCP has no deployment docs), F30 partial (user dev registry dgilli/selkies-rhel9, tag ceremony deferred to production)
…em R1 (deferred by user), progress/README/activeContext updates
…lli/selkies-rhel9 Image pushed: docker.io/dgilli/selkies-rhel9:latest (OCI manifest sha256:462464663a88..., config = local c7 99da8c1475f5); verified pull-by-digest + cold-boot smoke (web 200, ws 101, fresh-volume wallpaper). - deploy/nrp-selkies-rhel9.yaml: NRP template shape (Deployment+Service+ Ingress, nrp-workspace-* labels, haproxy) adapted to the LSIO-parity contract: Service 80->3000 only (selkies ws is same-origin via nginx /websocket -> internal 8082), USERNAME/PASSWORD nginx basic auth, /config + dshm volumes, NO securityContext (F28: NRP templates carry none), seccomp note for roadmap R1 (F55: docker default allows ptrace on kernel>=4.8); header documents the full NRP-env -> our-env mapping incl. inapplicable SELKIES_* vars for our selkies 348bc4f build
…i/selkies-rhel9:latest, NRP mapping (b97a611), F28/F30/F55 resolutions, build-deployment push recipe, task doc 280828_phase1-5-nrp-dev-push, state COMPLETE
…hboard app install/run now works) Image dgilli/baseimage-selkies:rhel9-p1-gnome (5c835fb6a147, c8). Revert: tag pre-r1-proot-apps -> 89f567a. - Dockerfile.rhel9: upstream proot-apps section ported verbatim (latest linuxserver/proot-apps release tarball -> /proot-apps + pversion; static proot/jq/ncat, no dnf deps) at the upstream placement (after user perms). The shared init-selkies-config bootstrap then wires ~/.local/bin unmodified (F53: shipping /proot-apps was the only image-side gap) - root/selkies-proot: RHEL9-guarded (distro-aware shared-tree pattern) bwrap stub loop before exec — F54's verified fix: glycin apps bundle bwrap whose user-ns availability test deadlocks inside proot's ptrace emulation (no-timeout await); the stub emits glycin's recognized 'No permissions' string -> clean NotSandboxed fallback. Re-applied on every invocation (install/update re-extracts restore the real binary) - Verified on fresh volume: /selkies-proot install+run filezilla -> FileZilla 3.68.1 rendered (WARNING: Glycin running without sandbox), marker-simulated re-extract re-stubbed, dash app entry created
…tic artifacts, 0.3.2), header image id, fix misaligned selkies line (pip version string contains spaces)
… F56 (shipping facts), task doc 280828_r1-proot-apps, roadmap/progress/toc/README/activeContext, dev registry re-push b70d42e3
…ifest, 5c835fb6 config; R1 included)
…te (F30 re-push, README/progress/phase1-5 doc, activeContext F-range + task-2 final clarification, GNOME task doc artifact, techContext RHEL9 table -> shipped state (F41 cvt correction, GNOME default DE, proot-apps row), quick-start RHEL9 build/run/smoke recipe + where-things-are)
docker.io/dgilli/selkies-rhel9 is PRIVATE; production pin v4-llvmpipe = c8 5c835fb6a147 (manifest b70d42e3...; :latest tracks dev). - deploy/nrp/selkies-rhel9.yaml.template: drop-in NRP placeholder template (standard set only — renderer-compatible): Service 8080 -> containerPort 3000 (ws same-origin via nginx /websocket; no 8082 exposure), USERNAME=abc + PASSWORD secretRef (their PASSWD/BASIC_AUTH_* vars are foreign to our image; missing PASSWORD = no-auth UI), NO encoder placeholder (our selkies 348bc4f rejects the reference config's vp8enc; H.264 streams via the pixelflux wheel), /config + dshm emptyDirs (ephemeral per user decision), imagePullSecrets dockerhub-dgilli (hardcoded — their sed set has no such placeholder), no securityContext (F28), Guaranteed QoS, GPU placeholders kept for phase 2 - deploy/nrp-selkies-rhel9.yaml: header note — standalone dev manifest; production artifact is the template above - Verified: replicated the reference 19-expression sed render + YAML parse + structural cross-check (ALL PASS); e-enc-test boot proved the vp8enc rejection + pixelflux x264enc fallback - memory-bank: F57, F30 resolved, ADR, task doc (separate MB commit)
…te contract + 3 breaking mismatches + pixelflux encoder truth), F30 fully resolved (private + v4-llvmpipe + pull secret), ADR (our repo owns the drop-in template; slu-nrp-k8s-vm = earlier attempt, reference only), task doc 280828_phase1-5-production-nrp, index files
Idempotent: ns auto-detect (context default) -> docker-registry secret dockerhub-dgilli from LOCAL podman auth (dgilli; accepts all hub alias keys, token never on a command line) -> verify selkies-password -> PSA check (rejects restricted/baseline — rootful pod, F28) -> render the template with the standard placeholder set -> kubectl apply -> wait Ready -> print URL/login/teardown. --dry-run does everything read-only. Live-verified 2026-08-28 against the real NRP cluster (nautilus context, ns slu-researchtechnologies-dgilli): pod Running 0 restarts on nautilus-it-cpu15.fullerton.edu, ingress live ~2 min after apply (initial 503 = controller reconcile timing), 401 anonymous / 200 abc, served page is the selkies web client off our nginx 1.20.1. Probe fixes learned live: kubectl version (not cluster-info — 403 under minimal NRP RBAC), podman auth key alias 'docker.io', wait-line quoting.
…researchtechnologies-dgilli, pod Running 0 restarts, ingress live, 401/200 auth gate, selkies client served off nginx 1.20.1); apply-nrp-e2e.sh one-shot; pod left running for user manual verification (teardown noted)
…2E PASSED (GNOME + SLU wallpaper + H.264 + FileZilla R1 on the live NRP cluster), user tore down the e2e pod, secrets documented (temp selkies-password + pull dockerhub-dgilli); F57/README/progress/activeContext closed out; Next = housekeeping, R1 step 3, phase 2
… (superseded by the completion entry)
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Thanks for opening this pull request! Be sure to follow the pull request template!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Benefits of this PR and context:
How Has This Been Tested?
Source / References: