How to use docker-slim in RHEL8 with Podman?

[bonymoloparambil]

How to use docker-slim in RHEL8 with Podman? I read that 'Red Hat does not support DockerSlim with Podman and no longer provides Docker in RHEL or Red Hat OpenShift. ' So what's the alternative here?

[kcq]

@bonymoloparambil you can try installing the podman-docker rpm on your RHEL8 machine or you can try pointing docker-slim at the podman unix socket with the --host flag. Podman API exposes Docker compatible API endpoints, but they are not 100% compatible in some cases, at least, it used to be the case. Ideally it'll be good to add support for the Podman container runtime for the build command. If you use the latest version you'll get partial Podman support, but only for the debug command.

[bonymoloparambil]

Thanks for your reply @kcq
I have uplifted docker-slim version as you suggested.

 [/local]$ docker-slim -v
mint version linux/amd64|Aurora|1.41.5|4cc2b185c9cdcd6d0586246e21d8aecc5d847feb|2024-07-01_04:33:18AM

I have tried pointing docker-slim at the podman unix socket by using --host flag but it didnot work, please see below.
[/local]$ docker-slim build --host unix://<podman.sock>
Incorrect Usage: flag provided but not defined: -host

Then I have [/local]$ export DOCKER_HOST=unix://<podman.sock>

Then it started giving me below issue,

[/local]$ docker-slim build  <my-image>
cmd=slim info=param.http.probe message='using default probe' 
cmd=slim state=started
cmd=slim info=cmd.input.params target.type='image' target.image=<my-image>' continue.mode='probe' rt.as.user='true' keep.perms='true' tags='' image-build-engine='internal' 
cmd=slim state=image.inspection.start
cmd=slim info=image id='sha256' size.bytes='64321220' size.human='64 MB' 
cmd=slim info=image.stack index='0' name='<my-image>' 
cmd=slim state=image.inspection.done
cmd=slim state=container.inspection.start
cmd=slim info=container status='created' name='mintk_380657_20240726084340' id='<xyz>' 
cmd=slim info=container status='running' name='mintk_380657_20240726084340' id='<xyz>' 
cmd=slim info=container message='obtained IP address' ip='<xyz>' 
cmd=slim info=cmd.startmonitor status='sent' 
cmd=slim info=event.startmonitor.done status='received.unexpected' data='{"name":"event.monitor.start.failed","data":{"component":"monitor.runner","state":"/","errors":["insufficient permissions"]}}
' 
mint: container stdout:
mint: container stderr:
time="2024-07-26T08:43:41Z" level=error msg="sensor: composite monitor - FAN failed to start running"
time="2024-07-26T08:43:41Z" level=error msg="sensor: failed to start composite monitor" error="insufficient permissions"
time="2024-07-26T08:43:41Z" level=error msg="sensor: run finished with error" error="run sensor without monitor failed: insufficient permissions"
time="2024-07-26T08:43:41Z" level=error msg="channel.Server.Start() - loop.Accept error = accept tcp [::]:65501: use of closed network connection"
time="2024-07-26T08:43:41Z" level=error msg="channel.Server.Start() - loop.Accept error = accept tcp [::]:65502: use of closed network connection"
mint: end of container logs =============
cmd=slim info=report file='slim.report.json' 
time="2024-07-26T10:43:41+02:00" level=error msg=terminating error="unexpected event type" stack="goroutine 1 [running]:\nruntime/debug.Stack()\n\truntime/debug/stack.go:24 +0x5e\ngithub.com/mintoolkit/mint/pkg/app.

Tried with sudo user, still it didn't work

Also xray command has given me as below,

[/local]$ docker-slim xray  <my-image>
cmd=xray state=started
cmd=xray info=cmd.input.params rm-file-artifacts='false' target='<my-image>' add-image-manifest='false' add-image-config='false' 
cmd=xray state=image.api.inspection.start
cmd=xray info=image size.bytes='64321220' size.human='64 MB' architecture='amd64' id='sha256:<xyz>' 
cmd=xray info=image.stack index='0' name='<my-image>' id='sha256:<xyz>' instructions='2' message='see report file for details' 
cmd=xray state=image.api.inspection.done
cmd=xray state=image.data.inspection.start
cmd=xray info=image.data.inspection.save.image.start
cmd=xray info=image.data.inspection.save.image.end
cmd=xray info=image.data.inspection.process.image.start
~~~~~
panic: runtime error: index out of range [2] with length 1
goroutine 1 [running]:
github.com/mintoolkit/mint/pkg/docker/dockerimage.LoadPackage({0xc0000680d0, 0xc5}, {0xc00005e9b0, 0x47}, 0x0?, 0x0?, 0x0?, 0x1, 0x0?, {0x0, ...}, ...)
        github.com/mintoolkit/mint/pkg/docker/dockerimage/dockerimage.go:1088 +0x5892
github.com/mintoolkit/mint/pkg/app/master/command/xray.OnCommand(0xc00060ea98, 0xc0004859a0, 0xc00060eab8, {_, _}, _, {_, _}, {0x0, 0x0}, ...)
        github.com/mintoolkit/mint/pkg/app/master/command/xray/handler.go:399 +0x2dcc
github.com/mintoolkit/mint/pkg/app/master/command/xray.glob..func1(0xc0005bfd00)
        github.com/mintoolkit/mint/pkg/app/master/command/xray/cli.go:340 +0x1dd8
github.com/urfave/cli/v2.(*Command).Run(0x3c7f900, 0xc0005bfd00, {0xc0006404c0, 0x2, 0x2})
        github.com/urfave/cli/[email protected]/command.go:279 +0x9dd
github.com/urfave/cli/v2.(*Command).Run(0xc000592580, 0xc0005bf700, {0xc0000501e0, 0x3, 0x3})
        github.com/urfave/cli/[email protected]/command.go:272 +0xc2e
github.com/urfave/cli/v2.(*App).RunContext(0xc0002a7200, {0x2910c28?, 0x3cfc5c0}, {0xc0000501e0, 0x3, 0x3})
        github.com/urfave/cli/[email protected]/app.go:337 +0x5db
github.com/urfave/cli/v2.(*App).Run(...)
        github.com/urfave/cli/[email protected]/app.go:311
github.com/mintoolkit/mint/pkg/app/master.Run()
        github.com/mintoolkit/mint/pkg/app/master/app.go:15 +0x45
main.main()
        github.com/mintoolkit/mint/cmd/mint/main.go:15 +0x187

I have not tried podman-docker rpm.

[kcq]

without monitor failed: insufficient permissions <- this might be caused by Podman running in rootless mode. Are you running Podman rootless? It might also be virtualization related... What's your environment like where you run RHEL8?

[kcq]

The --host flag is a global flag and it needs to be provided before the command name. The CLI package is very strict with those unfortunately.

[kcq]

Might add support for XRAY with Podman soon. Need only one API call for this, so stay tuned :-)

[bonymoloparambil]

Yes, Podman is running in rootless mode.

 security:
    apparmorEnabled: false
    capabilities:<xyz>
    rootless: true
    seccompEnabled: true