Getting updates to /etc/passwd and /var/lib/php

[cgwalters]

Reposting this from a different chat, so that the internet search finds it:

1. build a container image from a simple Container file, push to registry, deploy to vm with kickstart, all good works great.
2. Edit the Container file to additionally install nginx & php, rebuild the image, push the update to the registry.
3. On the existing install 'bootc update --check', 'bootc update', and reboot
4. Nginx fails to start because 'apache' user wasn't added to /etc/passwd, php-fpm wont start because /var/log/php-fpm wasn't addedIs there a way to allow or force updates to /etc and /var? Is there manual intervention? Or push a new image name and 'bootc switch'?

[cgwalters]

There's two parts to this, /etc and /var. Be sure to read the filesystem docs and the users and groups one for /etc/passwd.

The best fix IMO is to not have a static apache user at all, but use systemd DynamicUser=yes. If you do need a static user, you can use systemd-sysusers instead of useradd (as described in the users-and-groups doc).

For /var/log/php-fpm, I'd recommend logging to the journal instead of a lookaside file by default. But if you want that log directory still, use systemd tmpfiles.d to auto-create.

We do have a tracker for factory reset which in theory may start to help for both, but it's quite tricky because if you have local human users you usually don't want to have those go away for /etc/passwd...long term the real fix is to not try to mix all the users in one file - and sysusers+DynamicUser=yes etc. is going in that direction.

---

The other thing you can do of course is run nginx as a container (and have it be a logically bound image); that pushes the problem of users and filesystem mounts into how you deal with the container of course (by default e.g. you'd get /var/log/php-fpm in the container image but it'd be ephemeral).

[cgwalters]

Though for new directories in /var, at some point I may look at adding some opinionated tooling to translate that stuff automatically into tmpfiles.d entries, we have it in rpm-ostree today. There's just a bit of a bikeshed for where that logic would go.

[kclevenger]

• I set up a user in the Container file with home of /var/work.
• In a subsequent image update I add 'COPY var_file /var/empty/var_file'. So, two entirely separate locations within /var.
• The new var_file is in /sysroot/ostree/deploy/default/deploy/<sha...>/var/empty/var_file, and is not copied to /var/empty.

To me this seems unreasonably restrictive and IMO it should be more granular if possible.