rkt /映像构建：acbuild运行说明“已忽略”

Question

I'm experiencing unexpected behavior using acbuild run . To get used to rkt the idea was to start with a CentOS7 based container running a SSH host. The bare CentOS 7 container referenced below as centos7.aci was created on a up-to-date CentOS7 install using the instructions given here . The script used to build the SSHd ACI is

#! /bin/bash
acbuild begin ./centos7.aci
acbuild run -- yum install -y openssh-server
acbuild run -- mkdir /var/run/sshd
acbuild run -- sed -i 's/PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
acbuild run -- sed 's@session\s*required\s*pam_loginuid.so@session optional pam_loginuid.so@g' -i /etc/pam.d/sshd
acbuild run -- ssh-keygen -A -C "" -N "" -q
acbuild run -- echo 'root:screencast' | chpasswd
acbuild set-name centos7-sshd
acbuild set-exec -- /usr/sbin/sshd -D
acbuild port add ssh tcp 22
acbuild write --overwrite centos7-sshd.aci
acbuild end

When it's spinned up using rkt run --insecure-options=image ./centos7-sshd.aci the server runs but connection attempts fail because the password is not accepted. If I use rkt enter to get into the running container and re-run echo 'root:screencast' | chpasswd echo 'root:screencast' | chpasswd inside, I can login. So that acbuild run instruction has just not worked for some reason... To test a bit more, I replaced it by acbuild run -- mkdir ~/.ssh acbuild run -- echo "<rkt host SSH public key>“ >> ~/.ssh/authorized_keys

to enable key based instead of password login. It doesn't work: the key is refused. The reason is obvious once you look into the container: there's no authorized_keys file in ~/.ssh/ . If I add a
acbuild run -- touch ~/.ssh/authorized_keys instruction before the key appending attempt, the file is created but it's still empty. So again a acbuild run instruction didn't work - without error notice. May it be related to the fact that both „ignored“ instructions use operators like >> and | ? All commands shown in the examples I've seen don't use any such operators yet the docs don't mention anything and a Google search doesn't help either. In dockerfile RUN instructions they also work fine... what is going wrong here?

PS: I tried to use the chroot instead of the default systemd-nspawn engine in the „ignored“ acbuild run instructions => same results

PPS: there's no acbuild tag yet on StackOverflow so I had to tag this as rkt - could somebody with enough reputation create one please? Thx

Answer 1

Ok, I understood what happens using the the acbuild run --debug option. When

acbuild run -- echo 'root:screencast' | chpasswd

gets executed it returns Running: [echo root:screencast] , the pipe is executed on the host machine. To get the intended result it should be

acbuild run -- /bin/sh -c "echo 'root:screencast' | chpasswd"

or in generic form

acbuild run -- /bin/sh -c "<cmd with pipes>"

as explained here