Skip to content

chore: add envbox documentation #7198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Apr 26, 2023
Merged

chore: add envbox documentation #7198

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3987853
chore: add envbox documentation
sreya Apr 19, 2023
ae8e742
grammar
sreya Apr 19, 2023
e2f47e1
fmt
sreya Apr 19, 2023
54eb04f
add example of providing image pull secrets
sreya Apr 20, 2023
a25750f
comments
sreya Apr 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
add example of providing image pull secrets
  • Loading branch information
@sreya
sreya committed Apr 20, 2023
commit 54eb04fca534a35a7bf1c194f1947128017d20c1
36 changes: 35 additions & 1 deletion docs/templates/docker-in-workspaces.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ resource "kubernetes_pod" "dev" {

## Envbox

Envbox is an image developed and maintained by Coder that bundles the sysbox runtime. It works
[Envbox](https://github.com/coder/envbox) is an image developed and maintained by Coder that bundles the sysbox runtime. It works
by starting an outer container that manages the various sysbox daemons and spawns an unprivileged
inner container that acts as the user's workspace. The inner container is able to run system-level
software similar to a regular virtual machine (e.g. `systemd`, `dockerd`, etc). Envbox offers the
Expand All @@ -136,6 +136,40 @@ to sysbox's [compatibility matrix](https://github.com/nestybox/sysbox/blob/maste

To get started with `envbox` check out the [starter template](../../examples/templates/envbox) or visit the [repo](https://github.com/coder/envbox).

### Authenticating with a Private Registry

Authenticating with a private container registry can be done by referencing the credentials
via the `CODER_IMAGE_PULL_SECRET` environment variable. It is encouraged to populate this
[environment variable](https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-container-environment-variables-using-secret-data) by using a Kubernetes [secret](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#registry-secret-existing-credentials).

Refer to your container registry documentation to understand how to best create this secret.

The following shows a minimal example using a the JSON API key from a GCP service account to pull
a private image:

```bash
# Create the secret
$ kubectl create secret docker-registry <name> \
--docker-server=us.gcr.io \
--docker-username=_json_key \
--docker-password="$(cat ./json-key-file.yaml)" \
--docker-email=<service-account-email>
```

```yaml
# An example of referencing a secret in an environment variable.
kind: Pod
spec:
containers:
- name: envbox
env:
- name: CODER_IMAGE_PULL_SECRET
valueFrom:
secretKeyRef:
name: <name>
key: .dockerconfigjson
```
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It might make sense to show this in Terraform instead of YAML since 99% of people on this doc will be looking to add this to their envbox template in Coder. Or show both 🤷🏼

env {
  name = "CODER_IMAGE_PULL_SECRET"
  value_from {
    secret_key_ref {
      name = "<name>"
      key = ".dockerconfigjson"
    }
  }
}


## Rootless podman

[Podman](https://docs.podman.io/en/latest/) is Docker alternative that is compatible with OCI containers specification. which can run rootless inside Kubernetes pods. No custom RuntimeClass is required.
Expand Down
2 changes: 1 addition & 1 deletion examples/templates/envbox/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,7 @@ resource "kubernetes_pod" "main" {
}
container {
name = "dev"
image = "gcr.io/coder-dogfood/sreya/envbox:testtt"
image = "ghcr.io/coder/envbox:latest"
image_pull_policy = "Always"
command = ["/envbox", "docker"]

Expand Down