Main difference between "array" and "string" forms of `buildah config --entrypoint` command not described in the man page `buildah-config`

[makhomed]

Description Command buildah config --entrypoint not work as expected and as it documented.

podman hung when try to stop such container, because it can't detect what entrypoint is systemd. because container entrypoint is really /bin/sh, not /usr/lib/systemd/systemd.

Steps to reproduce the issue:

1. buildah from scratch
2. buildah config --entrypoint "/usr/lib/systemd/systemd" working-container
3. buildah inspect working-container | less

Describe the results you received:

        "config": {
            "Entrypoint": [
                "/bin/sh",
                "-c",
                "/usr/lib/systemd/systemd"
            ],

Describe the results you expected:

        "config": {
            "Entrypoint": [
                "/usr/lib/systemd/systemd"
            ],

Output of rpm -q buildah or apt list buildah:

buildah-1.33.7-2.el9_4.x86_64

Output of buildah version:

Version:         1.33.7
Go Version:      go1.21.10 (Red Hat 1.21.10-1.el9_4)
Image Spec:      1.1.0-rc.5
Runtime Spec:    1.1.0
CNI Spec:        1.0.0
libcni Version:  v1.1.2
image Version:   5.29.2
Git Commit:
Built:           Wed Jun 12 04:48:06 2024
OS/Arch:         linux/amd64
BuildPlatform:   linux/amd64

Output of cat /etc/*release:

VERSION_ID="9.4"
PLATFORM_ID="platform:el9"

Output of uname -a:

Linux example.com 5.14.0-427.20.1.el9_4.x86_64
#1 SMP PREEMPT_DYNAMIC Fri Jun 7 14:51:39 UTC 2024
x86_64 x86_64 x86_64 GNU/Linux

Output of cat /etc/containers/storage.conf:

# cat /etc/containers/storage.conf | grep -P '^[^#]'
[storage]
driver = "overlay"
runroot = "/run/containers/storage"
graphroot = "/var/lib/containers/storage"
[storage.options]
additionalimagestores = [
]
pull_options = {enable_partial_images = "false", use_hard_links = "false", ostree_repos=""}
[storage.options.overlay]
mountopt = "nodev,metacopy=on"
[storage.options.thinpool]

[makhomed]

workaround exists:

buildah config --entrypoint '[ "/usr/lib/systemd/systemd" ]' $container

in this case all works as expected:

# buildah inspect working-container | less

        "config": {
            "Entrypoint": [
                "/usr/lib/systemd/systemd"
            ]
        },

probably this is not a bug in buildah binary, but this is the bug in the man buildah-config, because in the manual not described this difference - "when the entrypoint is specified as a string" - then '["/bin/sh", "-c"]' added as silently forced prefix to entrypoint. But "if you use the array form" - in this case '["/bin/sh", "-c"]' not added as prefix. This main difference between two forms of entrypoint not described in the buildah configuration.

[rhatdan]

Interested in opening a PR to fix documentation?

[makhomed]

Interested in opening a PR to fix documentation?

Sorry, but not.

Because English is not my native language, and I am not sure in the high quality of such my PR.

[github-actions[bot]]

A friendly reminder that this issue had no activity for 30 days.

[gcb]

It's ironic that this issue was opened trying to add systemd, as it have the exact same issue with some keys randomly acting as array append while most others do not, e.g. ExecStart=

But differently from systemd workaround, which is to set it to empty before you expect to set the only value (

ExecStart=
ExecStart=/surely/only/this/now

) on buildah it seems to work but then add the sh back!

$ buildah config --entrypoint '[]' working-container
$ buildah config --entrypoint '/usr/bin/notsh' working-container
$ buildah inspect working-container
...
        "config": {
            "Entrypoint": [
                "/bin/sh",
                "-c",
                "/usr/bin/notsh"
            ],

[gcb]

buildah already shows warnings for even more obvious things when config --entrypoint, such as:

WARN[0000] cmd "${LPORT:-9999}" exists and will be passed to entrypoint as a parameter

If you point me to the general direction of the code I can try a new PR to also warn when string values where appended to an array for all config that happens to append. That's the right thing to do here IMO.

[github-actions[bot]]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

So buildah config --entrypoint '["/usr/bin/notshell"]' working-container Does what you expected