How to prevent copied /etc/resolv.conf from being overwritten inside an Execution Environment?

Get Help
,
1

I’m trying to copy my own /etc/resolv.conf inside an Execution Environment but it is always overwritten somehow.
How can we prevent that from happening?

No matter in which section I put RUN chmod 444 /etc/resolv.conf, it always fails with the same eroor message Read-only file system;

Running ansible-builder build -vvv --container-runtime=docker --context="/ee/context" --file="/ee/files/definition/file.yml" --tag="tag:version" -v3 with this definition file:

version: 3

dependencies:
  ansible_core:
    # Require minimum of 2.15 to get ansible-inventory --limit option
    package_pip: ansible-core<2.19
  ansible_runner:
    package_pip: ansible-runner
  galaxy:
    collections:
      - name: ansible.mysql
        ...
  python_interpreter:
    package_system: python311
    python_path: /usr/bin/python3.11
  python:
    - wheel
      ...

additional_build_steps:
  append_base:
    - RUN $PYCMD -m pip install -U pip
    - RUN dnf -y install dnf-plugins-core
    - RUN dnf -y install epel-release epel-next-release
    - RUN dnf -y config-manager --set-enabled crb
    - RUN mkdir -p /etc/ansible
  append_final:
    - COPY --from=quay.io/ansible/receptor:devel /usr/bin/receptor /usr/bin/receptor
    - RUN mkdir -p /var/run/receptor
    - RUN git lfs install --system
    - RUN alternatives --install /usr/bin/python python /usr/bin/python3.11 311
    - COPY ./etc/ansible/ansible.cfg /etc/ansible/
    - COPY ./etc/resolv.conf /etc/
    - COPY ./root/.gitconfig /root/
    - RUN chmod 644 /etc/ansible/ansible.cfg
    - RUN chmod 444 /etc/resolv.conf
    - RUN chmod 600 /root/.gitconfig

I get:

...
#47 [final 17/19] RUN chmod 444 /etc/resolv.conf
#47 0.164 chmod: changing permissions of '/etc/resolv.conf': Read-only file system
#47 ERROR: process "/bin/sh -c chmod 444 /etc/resolv.conf" did not complete successfully: exit code: 1

ansible-builder ee

2

hello,
2 things : copy —chmod=444 might be more appropriate instead of running an additionnal RUN command.
That being said, i think there’s a mechanism in docker/podman where the resolv.conf file is anyway overriden dynamically at run time (—dns and —dns_search options to customize); i saw somebody using a CMD option where first a custom resolv.conf was copied over /etc/resolv.conf, but it looked dirty , and it wasn’t in the context of an execution environment, might work though :blush:

3

While chmod or setfacl can help, it rarely does with that file since anything writing to it is doing so with root permissions. I would use the file action and set the the file system attribute to ‘immutable’:

ansible -m file -a 'path=/etc/resolve.conf attributes="+i"' targethost
4

What @johan said. /etc/hosts and /etc/resolv.conf are files managed by docker/podman and you can’t really enforce the content of these files. You have to use --dns* and --add-host docker command line options.

There is one idea though. You can try mounting your custom file in container using -v /your/resolv.conf:/etc/resolv.conf. I vaguely recall that I tried to do this with /etc/hosts but I can’t recall if it worked or not.