Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow creating of fuse3-based distribution and support mount/unmount using fusermount3 if it is available #94

Open
wants to merge 5 commits into
base: master
Choose a base branch
from

Conversation

tildeslu
Copy link

In some HPC environments (e.g. PUHTI supercomputer) only fuse3 setuid-helper binary (fusermount3) is shipped on EL8.
Fuse2 libraries are still available but cannot be used in unprivileged way because of absence of setuid-helper, so the only solution is to use fuse3 variant of CVMFS.

This patch changes fuse3 support from apptainer-only to a generic option.

Copy link
Collaborator

@DrDaveD DrDaveD left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the contribution! This reminds me about #54 though; I really ought to have some ci checks for this project.

makedist Outdated
Comment on lines 40 to 42
elif [ "$1" = "-3" ]; then
FUSE3=true
shift
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not very happy with an option to do this. Can't this be discovered automatically somehow? Maybe looking for fusermount3 like is done in umountrepo?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem is that you may need to create a distribution on another machine to be used on HPC node.
In my case fuse2 was available on login node but not on worker nodes. So there should be some way to force this.
It can be done by setting environment variable if option is not desired.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, I don't prefer an environment variable, I just prefer to have a default that's right most of the time. Let's have it default to fuse3 if fusermount3 is found on the host where makedist is run, and have -3 and -2 options to override the default.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new CI checks look good, but I'd still like to see the suggestion I had above:

Let's have it default to fuse3 if fusermount3 is found on the host where makedist is run, and have -3 and -2 options to override the default (for the non -s case).

makedist Outdated Show resolved Hide resolved
makedist Outdated Show resolved Hide resolved
@tildeslu tildeslu requested a review from DrDaveD August 14, 2024 12:20
@DrDaveD
Copy link
Collaborator

DrDaveD commented Aug 16, 2024

By the way, do your compute nodes not have user namespaces enabled? If you use the cvmfsexec command with user namespaces enabled it shouldn't try to use fusermount or fusermount3; only the mode 1 mountrepo/umountrepo commands do that.

@tildeslu
Copy link
Author

Unfortunately unprivileged user namespaces are not usable in that environment. The kernel is capable, but it's not enabled in system config. And that's the OS image that is shipped by HPC vendor. Also, they ship both fuse2 and fuse3 libraries but fusermount binary is removed from the image, only fusermount3 is provided.
There is also setuid Apptainer installation which natively supports fuse3 - but again, because of missing support for unprivileged user namespaces, it is not possible to run nested containers.

@DrDaveD
Copy link
Collaborator

DrDaveD commented Sep 10, 2024

I have finally gotten around to making CI checks for cvmfsexec here now. Please rebase your PR on the current master so we can see if it broke any functionality or not.

@tildeslu
Copy link
Author

tildeslu commented Sep 12, 2024

Please rebase your PR on the current master so we can see if it broke any functionality or not.

Done. I see CI tests running on my branch but they are not reported in the pull request for some reason.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants