27
Proxmox Virtual Environment 9.1 available (www.proxmox.com)
submitted 11 months ago by to c/proxmox@lemmy.world
12 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 11 months ago (9 children)

OCI images is very exciting. But, I don't see any way to keep them updated. You don't normally do an update on the applications inside an OCI container, you usually rebuild the container on a new image.

  • permalink
  • fedilink
  • source
  • hideshow 9 child comments
    •
  • [–] [S] 4 points 11 months ago (5 children)

    Sounds like they're used as a template and it's now a regular LXC that you can treat like a running distro.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 5 points 11 months ago (4 children)

    Right, but these containers are usually not designed to be updated like that. It totally defeats the nature of the OCI image and delivering something that has been tested to work. I'm sure there is a use case for this, but it seems more like a gimmick than a useful feature.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] [S] 1 point 11 months ago (3 children)

    Actually, I could see myself using this for development if there were an easy way to package it back into a container image.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 11 months ago (2 children)

    Back into an OCI image? I don't know if lxc can do that, but podman can. I think it is podman save that allows you to save your current container as an image. Or, even better would be to use buildah. With buildah your expected workflow is to kind of run a container, run a script against that container, then save it at the end. In fact I'm specifically thinking of images I've created with buildah as being almost completely useless with this LXC technique. I've used the RHEL UBI micro image before and it doesn't even have a package manager. You actually mount the container to the host and use the host's package manager to install what is needed and then unmount it to save. It makes a super slim image with as little attack surface as possible.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 11 months ago (1 child)

    My reading of it makes it sound like a local container repo. So if you have 5 containers using nginx:latest it pulls from the template not an online repo each time.

    But I could be wrong, I haven't played with PVE LXCs yet.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 11 months ago

    Yes, but then you're on that specific version of nginx. A lot of containers are built using a multi stage build process where the first stage uses a container with build tooling to build the application, then a second stage installs the result. So your end image doesn't have the build tooling and no way to update. That's intentional for security reasons. Images are meant to be immutable.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 11 months ago* (last edited 11 months ago)

    My thoughts exactly. I wonder if they'll make it easy to re-create with a newer image. The compiled app binaries are usually copied into the image via Containerfile with no way to update it from inside the container.

    Edit: it's addressed in the Proxmox board:

    https://forum.proxmox.com/threads/proxmox-virtual-environment-9-1-available.176255/

    That one of the major reasons for why it's a tech preview, i.e., it's a bit involved. You basically need to create separate mounpoints for the data volumes (they are logged in CT create task) and then one can create a CT from the new image and move over the data volume. Making this simpler and more approachable is on the roadmap, but no promises how fast we can deliver here.

  • permalink
  • fedilink
  • source
  • parent