I cannot do anything with this. I don't manage the Jenkins serversto explore what's the difference.

from s2i-perl-container.

It looks like it fails with docker-1.8.2-10.el7.x86_64 that is the latest stable version in RHEL-7. It works with 1.9.1 that can be found in Fedora.

OpenShift, what docker version do you use?

hhorak wants to revert the feature of logging to stderr. Is that acceptable solution for OpenShift?

from s2i-perl-container.

As @ppisar says, the perl image as it is now does not work on up2date RHEL, not even on up2date CentOS.

from s2i-perl-container.

@bparees setting P1 as the image seems to be broken on RHEL7

@hhorak @ppisar are you guys working on fix?

from s2i-perl-container.

@ppisar i'm fine with reverting logging to stderr if that breaks RHEL7

from s2i-perl-container.

@mfojtik @ppisar @hhorak agree i'm fine w/ reverting it. could we try another solution like using a pipe (https://httpd.apache.org/docs/1.3/logs.html#piped) and sending the log through cat or tail or something?

from s2i-perl-container.

On Mon, Apr 04, 2016 at 02:05:45PM -0700, Ben Parees wrote:

@mfojtik @ppisar @hhorak agree i'm fine w/ reverting it. could we try
another solution like using a pipe
(https://httpd.apache.org/docs/1.3/logs.html#piped) and sending the log
through cat or tail or something?

What's the additional value of sending logs into another process? At the end
you need to write errors into stderr. It does not matter whether it's httpd or
another process that gets permission denial.

Could you explain why current code works in your Jenkins instance? Is that
because you use newer docker that is not yet available in RHEL/CentoOS?

I looked into httpd Dockerfile and it actually does not send errors to stderr
even though the commit message says so. I need to ask it's maintainer what
it means.

from s2i-perl-container.

httpd Dockerfile maintainer said it was bad commit message.

I believe a new docker-1.9.1-25.el7.x86_64 should bring support for the stderr, thus no reversion is needed and users should upgrade docker instead.

from s2i-perl-container.

@ppisar agree. I believe we use that docker version, but I will verify it. Decreasing priority for this issue then.

from s2i-perl-container.

What's the additional value of sending logs into another process? At the end you need to write errors into stderr. It does not matter whether it's httpd or another process that gets permission denial.

Is the problem actually that nothing can write to stderr? that seems unlikely to me. That would be a much more significant bug in docker. I assume it has more to do w/ the mechanism being employed.

Could you explain why current code works in your Jenkins instance? Is that because you use newer docker that is not yet available in RHEL/CentoOS?

Jenkins doesn't use httpd. I'm not sure if it logs anything to stderr or not.

from s2i-perl-container.

On Tue, Apr 05, 2016 at 06:17:18AM -0700, Ben Parees wrote:

What's the additional value of sending logs into another process? At
the end you need to write errors into stderr. It does not matter
whether it's httpd or another process that gets permission denial.

Is the problem actually that nothing can write to stderr? that seems
unlikely to me. That would be a much more significant bug in docker. I
assume it has more to do w/ the mechanism being employed.

Opening /proc/self/fd/2 is like reopening pipe that connects to docker
client's stderr. That's really a bug in the docker. You cannot open the stderr
with docker-1.8.2:

docker run --rm application '/bin/bash' -c 'echo test >/proc/self/fd/2'

/bin/bash: /proc/self/fd/2: Permission denied

The same with /dev/stderr that is a symlink to /proc/self/fd/2.

What works is writing to already opened descriptor:

docker run --rm application '/bin/bash' -c 'echo test >&2'

test

The question is if httpd's piped log command inherits opened descriptors.
I will try it. But be ware the more layers you have the more fragile the tool
is.

Could you explain why current code works in your Jenkins instance? Is
that because you use newer docker that is not yet available in
RHEL/CentoOS?

Jenkins doesn't use httpd. I'm not sure if it logs anything to stderr or
not.

It's not about httpd. It's about docker.

from s2i-perl-container.

On Tue, Apr 05, 2016 at 04:16:47PM +0200, Petr Pisar wrote:

What works is writing to already opened descriptor:

docker run --rm application '/bin/bash' -c 'echo test >&2'

test

The question is if httpd's piped log command inherits opened descriptors.
I will try it. But be ware the more layers you have the more fragile the tool
is.

And the answer is the shell redirection (ErrorLog "|$/usr/bin/cat >&2") does
not work because of httpd. It's an undocumented feature that error log of the
main (i.e. non-virtual HTTP host) httpd process always has second decriptor
cloned to the first descriptor (i.e. stderr is stdout). See open_error_log()
function httpd's server/log.c source:

    /* Spawn a new child logger.  If this is the main server_rec,
     * the new child must use a dummy stderr since the current
     * stderr might be a pipe to the old logger.  Otherwise, the
     * child inherits the parents stderr. */
    rc = log_child(p, fname, &dummy, cmdtype, is_main);

For you information, this is the 5.20/contrib/etc/httpdconf.sed change I
tested:

-s%^ErrorLog "logs/error_log"%ErrorLog "/proc/self/fd/2"%
+s%^ErrorLog "logs/error_log"%ErrorLog "|$/usr/bin/cat >&2"%

Therefore my conlusion is that either we will stop logging to stderr so the
image will work with docker-1.8.2, or we will keep the logging to stderr as as
implemented know and the image will not work with docker-1.8.2.

Because docker-1.9.1 that fixes the bug should be available to users now,
I believe we should choose the second option.

-- Petr

from s2i-perl-container.

+1 to we should say only docker-1.9 is supported. @bparees agree?

@ppisar thanks for detailed explanation!

from s2i-perl-container.

@mfojtik depends, what are we pre-reqing for OSE3.2?

from s2i-perl-container.

and yes, thank you @ppisar!

from s2i-perl-container.

@bparees I believe docker 1.9.x as that is what our jenkins runs :-)

from s2i-perl-container.

spoke with @danmcp and @smarterclayton, we can't afford to have this image broken for people using docker 1.8, so we need to revert the change for now and revisit this in the future when it's reasonable to assume no one is running docker 1.8 anymore.

from s2i-perl-container.

fixed by #78

from s2i-perl-container.