QM(8)

📦
version 1.3 · 2 versions
, in fedora 43, fedora 44

💖 QM — bestie's guide to the Containerized Functional Safety QM vibe 💖

okay so welcome to QM(8) from the System Manager's Manual — yes she's a real manual page, section 8, and she's about setting up a containerized environment for running Functional Safety QM (Quality Management) software. let's get into it 🫶

✨ NAME ✨

QM — Set up a Containerized environment for running Functional Safety QM (Quality Management) software. that's it, that's the whole job. slay.

🌸 SYNOPSIS 🌸

This package lets you set up an environment that stops applications and container tools from interfering with other processes on the system. no cap, that's the entire point. 💅

The QM runs its own version of systemd and Podman — and like, it doesn't just isolate the applications and containers launched by systemd and Podman, it isolates systemd and Podman themselves. In other words: the systemd and Podman launched inside the QM environment cannot affect the systemd or Podman processes running outside of that environment. they literally cannot touch each other. it's giving separate universes ✨

Software installed into the QM environment under the /usr/lib/qm/rootfs directory is automatically isolated from the host. And if developers need to further isolate their applications from other processes in the QM? they should use container tools like Podman. periodt.

🎀 INSTALL 🎀

After the QM software package is installed, run the /usr/share/qm/setup script to set up and install the /usr/lib/qm/rootfs with packages to run an isolated environment. The setup script installs the selinux-policy-targeted, podman, systemd, and bluechi packages. Then Setup enables and starts a Podman quadlet service qm.service (qm.container). she's alive bestie 🦋

This Podman quadlet can be examined with the following command:

systemctl status qm.service
● qm.service
     Loaded: loaded (/etc/containers/systemd/qm.container; generated)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: active (running) since Tue 2023-04-11 15:43:45 EDT; 28min ago
   Main PID: 993674 (conmon)
      Tasks: 11 (limit: 76801)
     Memory: 275.1M (swap max: 0B)
        CPU: 4.527s
     CGroup: /qm.service
             ├─libpod-payload-00de006493bc970788d6c830beb494a58a9a2847a5eda200812d3a8b4e214814
             │ ├─init.scope
             │ │ └─993676 /sbin/init
             │ └─system.slice
             │   ├─dbus-broker.service
             │   │ ├─993763 /usr/bin/dbus-broker-launch --scope system --audit
             │   │ └─993764 dbus-broker --log 4 --controller 9 --machine-id 4ce4c21b211d41e78b7b64418c1c0cb5 -->
             │   ├─systemd-journald.service
             │   │ └─993718 /usr/lib/systemd/systemd-journald
...

look at her go 😭 main character energy fr

🌈 CGroups and container configuration 🌈

The options in the qm.container file can be overridden by using drop-in files, in the directories /etc/containers/systemd/qm.container.d or /usr/lib/containers/systemd/qm.container.d. This allows overriding, for example, CGroup options like Service.CPUWeight, or podman options like Container.Volume. Such options will affect all the processes running in the qm container. so like, be mindful bestie, it's a whole-container situation 🫶

🍓 Install Additional packages in QM 🍓

If other packages need to be added into the QM environment, use the dnf command on the host. For example, the following example installs the dnf command into the QM environment:

# dnf install --installroot=/usr/lib/qm/rootfs dnf
Unable to read consumer identity

Last metadata expiration check: 0:33:12 ago on Tue 11 Apr 2023 03:42:09 PM EDT.
Dependencies resolved.
================================================================================================================
 Package                                Architecture       Version                     Repository          Size
================================================================================================================
Installing:
 dnf                                    noarch             4.14.0-2.fc38               fedora             478 k
...

see how easy that was? iconic. 💅

🧚 Entering the QM 🧚

To enter the QM environment, use this Podman command to launch containers within it.

sh-5.2# podman exec -ti qm sh
sh-5.2#

The SELinux label can be checked by executing the following:

sh-5.2# id -Z
system_u:system_r:qm_t:s0:c35,c404

Notice that the process is running as qm_t, indicating that the process is a confined QM process within the QM environment. that's the whole tell, iykyk 👑

Containers can now be run within the QM environment using Podman.

sh-5.2# podman run --rm ubi9-minimal echo hi
Resolved "ubi9-minimal" as an alias (/etc/containers/registries.conf.d/000-shortnames.conf)
Trying to pull registry.access.redhat.com/ubi9-minimal:latest...
Getting image source signatures
Checking if image destination supports signatures
Copying blob 7bffb309b4e8 done
Copying config 96179718b4 done
Writing manifest to image destination
Storing signatures
hi

It is recommended that Podman quadlets are used to run additional containerized applications within the QM. All applications within the QM environment are prevented from interfering with applications running outside of the QM environment. no crossover, no chaos, just vibes 🌸

💜 Configuring bluechi agent in the QM 💜

The configuration of the host's /etc/bluechi/agent.conf file is copied into the QM every time the qm.service is started, with the nodename of the host's agent.conf modified by prepending qm. on the front of the nodename. If the host's /etc/bluechi/agent.conf does not exist, then the QM bluechi agent will default to qm.$(hostname).

If you want to permanently modify the bluechi agent within the QM, you can add config to the /usr/lib/qm/rootfs/etc/bluechi/agent.conf.d/ directory, or modify the /etc/containers/systemd/qm.container quadlet file to not execute the bluechi-agent setup script. your call, bestie, both are valid 🎀

⭐ Using systemd drop-in with QM ⭐

The systemd drop-in feature allows users to extend or modify the configuration of systemd units without directly editing the unit files provided by the system package. so polite of it honestly.

In this example, we will add the AllowedCPU to set as 1 to qm.service that quadlet generated:

🦋 Create allowedcpus.conf 🦋

cat  /etc/systemd/system/qm.service.d/allowedcpus.conf

# Contents of qm.continer.d/allowedcpus.conf
[Service]
AllowedCPUs=1

(and yes, that comment path is written exactly the way it is in the source, typos and all — we don't edit the queen 💅)

🔥 Tools 🔥

qm-rootfs

Prints the qm rootfs location previously configured during setup.

qm-storage-settings

Setup the initial QM configuration for storage using the following config files and changes:

  • ${ROOTFS}/etc/containers/storage.conf
    • uncomment additionalimagestores
    • add /var/lib/shared into additionalimagestores
    • uncomment and set to true the option transient_store
  • ${ROOTFS}/etc/containers/container.conf
    • add [engine] and TMPDIR

🌟 SEE ALSO 🌟

and that's the whole page bestie ✨ this was QM(8) from the System Manager's Manual — no version number or date on this one, she's timeless like that. mwah, go set up your containerized environment, you're gonna ate 💖🎀🫶

📦 where this page comes from