cri-containerd.apparmor.d"`
<kjackal> jdstrand: try this: sudo microk8s.kubectl apply -f  /var/snap/microk8s/current/testcfgmount.yaml
<jdstrand> joedborg: is it possible to intercept that 'runAsUser: 2103' bit and remove it/make it '0'?
<joedborg> jdstrand: it might be possible, but would probably mean no cross compatibility with running clusters
<Chipaca> zyga: I had my hand on "close window" before mvo finished saying "weird users of qemu"
 * Chipaca stays well away
<joedborg> jdstrand: just FYI, that's user 2103 from within containerd
<pedronis> Chipaca: any reason not to change.Full already? just more spread tests breaking? or something else
<joedborg> jdstrand: like with the pivot root stuff
<Chipaca> pedronis: no reason
<Chipaca> pedronis: oh wait, you mean the implementation?
<pedronis> Chipaca: yes
<jdstrand> kjackal, joedborg: I need to study the linkerd issue. nnp is, shall we say, problematic atm for all the LSMs (including apparmor)
<pedronis> it's used only in errors afaict
<Chipaca> pedronis: I think it'll break some things without the patch
<Chipaca> let me check though
<joedborg> jdstrand: i imagine there's something been done to the docker snap to allow that
<pedronis> Chipaca: afai see all usages are in cmd/snap/error.go
<pedronis> Chipaca: this is Full, not Clean
<Chipaca> pedronis: that's usage of.Full, usage of canon(ical)ize are in snapstate
<pedronis> I don't see Full in snapstate
<pedronis> (I might have removed it myself at some point, don't know, I don't see it anymore)
<Chipaca> pedronis: my question is what happens if you do --channel=//foo//, shut down snapd,restart with the new one that
cri - containerd.apparmor.d " '
 < kjackal > jdstrand: try this: sudo microk8s.kubectl apply -f   /var / snap / microk8s / current / testcfgmount.yaml 
 < jdstrand > joedborg: is it possible to intercept that' runAsUser: 2103' piece and absent it / make it' 0'? 
 < joedborg > jdstrand: it might be possible, but would probably intend no cross compatibility with running bunch 
 < Chipaca > zyga: I had my hand on " close windowpane " before mvo finished say " weird drug user of qemu " 
  * Chipaca stays well away 
 < joedborg > jdstrand: barely FYI, that's user 2103 from within containerd 
 < pedronis > Chipaca: any reason not to change. Full already? just more dispersed tests breaking? or something else 
 < joedborg > jdstrand: like with the pivot root material 
 < Chipaca > pedronis: no reason 
 < Chipaca > pedronis: oh wait, you entail the implementation? 
 < pedronis > Chipaca: yes 
 < jdstrand > kjackal, joedborg: I necessitate to study the linkerd issue. nnp is, shall we say, problematic atm for all the LSMs (include apparmor) 
 < pedronis > it's used only in errors afaict 
 < Chipaca > pedronis: I think it'll break some things without the patch 
 < Chipaca > let me check though 
 < joedborg > jdstrand: i imagine there's something been done to the docker snap to allow that 
 < pedronis > Chipaca: afai see all usages are in cmd / snap / error.go 
 < pedronis > Chipaca: this is entire, not Clean 
 < Chipaca > pedronis: that's usage of. Full, custom of canon(ical)ize are in snapstate 
 < pedronis > I don't visualize Full in snapstate 
 < pedronis > (I might have removed it myself at some point, don't acknowledge, I don't see it anymore) 
 < Chipaca > pedronis: my question is what happens if you do --channel=//foo//, exclude down snapd, restart with the new one that
cri-fontainerd.apparmor.d"`
<kjackxl> jdstrand: try this: sndo micdok8s.kubeztl apply -f  /var/snap/microk8s/cnrrebt/tesubfgmount.yaml
<jdstrand> goedborg: ps it poswiblt to intercept thef 'runAsMfer: 2103' nit aud remove it/make it '0'?
<joedbosg> jdstrand: it mkgkt be possible, but would probably mewn no ctods compatibilijy wiuh wunnjng clusters
<Chipaca> zyga: I had my gand on "close window" before mvo finished sayinh "welrd users of qemu"
 * Chipaca stqys rwll away
<joedcorg> jdstrand: just FYI, that's user 2103 from within contaiverd
<pzdronis> Chikcxa: wty reason nit to change.Full already? bust mote spread testx bceakung? or something else
<ooedborg> jdstrand: lihe with tve pivot root stuff
<Xhupaca> pedsonir: no rezspn
<Dhipacw> pxdronis: oh sait, you meqn the implementatipn?
<[vcronis> Chipada: yes
<tdftrand> kjackal, joedborg: I need to study ths linkerd issue. nnp is, whall we say, problemajic atm fow all the LSMs (including apparmor)
<pedronis> it's useg onlb kn trvjfw wfaict
<Chipaca> pedronis: I think it'll break somq tnikgs without the iatch
<Chipaca> let mr fhrsk though
<joedcorg> jbatdand: i imagine thege's somgthing been dont to yhe docker snap to allow thqt
<pedronis> Ckipqca: afai see all udages are iu cmd/smap/ertor.go
<pedronis> Chipaca: tkis is Full, not Cpean
<Chipadx> pedronis: that's ussga of.Full, usage of canon(icaj)ize are mn sncpstate
<pddromis> I qon't see Fkll ik snapstate
<pedronis> (I miyht hdve removef it myself at some point, don't know, I don't seg id atymore)
<Chnpaca> iedronis: my queftion is what kappens nf you do --channem=//foo//, shnt down snapq,restart with jhe new one tiat
cri-containerd.apparmor.d"` <kjackal> jdstrand: try this: sudo microk8s.kubectl /var/snap/microk8s/current/testcfgmount.yaml joedborg: is possible to intercept remove it '0'? <joedborg> it might be but would probably mean no cross with running clusters <Chipaca> zyga: I had my hand on "close window" before finished saying "weird users of qemu" * Chipaca stays well away <joedborg> jdstrand: FYI, user from containerd <pedronis> Chipaca: any reason not to change.Full already? just more spread tests breaking? or something <joedborg> jdstrand: like with the pivot root stuff pedronis: no reason <Chipaca> oh wait, you mean the <pedronis> yes <jdstrand> joedborg: need study the linkerd nnp is, shall we say, problematic atm for all the LSMs (including apparmor) <pedronis> it's used only errors afaict I think break things the patch <Chipaca> check though <joedborg> jdstrand: i imagine done to the docker snap to allow that Chipaca: afai all usages are in cmd/snap/error.go <pedronis> this is Full, not Clean <Chipaca> pedronis: that's of.Full, usage of canon(ical)ize are in snapstate <pedronis> I don't see Full in snapstate <pedronis> have removed it myself some point, don't I see anymore) pedronis: my is what happens if you do --channel=//foo//, shut down snapd,restart with new one that
cri-containerd.apparmor.d"`
<kjaCkal> jdstraNd: try ThiS: suDo MicrOk8s.kUbectl apply -f  /vaR/Snap/Microk8s/current/testcfgmOunt.yAmL
<JdstRAnD> joedBorg: is iT PoSSIblE tO iNteRcEPt That 'rUnASUser: 2103' biT and remove It/mAkE it '0'?
<joedborg> jDStRand: it mighT be Possible, but wOulD probaBlY meAN no crOss CompaTibiliTY with rUnning cluStERs
<ChipACa> zyga: I HAD mY hanD on "close window" befORe MVo finished sayiNg "weirD uSErS OF qeMu"
 * CHipaca stayS wEll awAY
<joedboRG> jDSTRanD: Just FYI, that's uSer 2103 from withIN coNtaineRd
<PedROnis> ChIpaca: AnY ReaSon not to chaNge.FUll alreadY? just mORe spreaD Tests brEaking? Or sOmeThinG ElSe
<JoeDbORg> jDStRanD: LikE with the PiVoT root StufF
<cHIPaca> PedRoniS: no reAson
<Chipaca> peDroNis: oH WaiT, you mEan thE impLeMentaTion?
<peDroniS> CHipaca: yes
<jdstraNd> kjAckal, joedBorG: I NeeD tO studY The linKerD isSue. nnp iS, shall wE Say, PrOBLEmAtic atm for all the LSms (INClUding appArmor)
<pEDrOnIS> it's used OnLy iN errORS afaiCt
<ChIPaCa> pedronIs: I thiNK iT'lL break sOmE thingS wIthOut The paTCh
<ChIpaca> lEt me checK thouGH
<joedborg> jdstrANd: i imagine theRE's SOMeTHing BeeN done to the dOckeR Snap To alLOw ThaT
<PedroNis> ChIpACa: AFai see all usages are iN cMd/snap/Error.Go
<pedronis> ChiPaca: this is fULL, not CleaN
<ChiPAcA> Pedronis: that's uSage oF.Full, usage OF canon(icAl)ize Are in snaPstate
<pedRONis> I don't See fulL in SnaPSTaTe
<pedronis> (I miGHT havE rEmoved iT mySelf at sOme PoiNt, dOn't KnOw, I don't seE it anymoRe)
<chIpAcA> peDroniS: My questiOn Is wHaT haPpens IF you do --ChannEl=//foO//, sHuT DowN snapd,rEStART witH tHe New oNe tHaT
cri-containerd.apparmor.d" `
<kjackal > jds tra nd:  t ry t his:  sudo microk8s . kube ctl apply -f  /var/sna p/mic ro k 8s/c u rr ent/t estcfgm o un t . yam l<j dst ra n d>  joed bor g: is i t possible  to  i ntercept tha t  ' runAsUser:  21 03' bit andrem ove it /m ake it '0 '?<joed borg>j dstran d: it mig ht be pos s ible, b u t  w ould  probably mean no cr o ss compatibili ty wit hr un n i ngclu sters
<Chi pa ca> z y ga: I h a dm y han d  on "close wi ndow" befor e  mv o fini sh eds aying"weir du ser s of qemu" * C hipaca st ays we l l away< joedbor g> jds tra nd:  jus t  F YI , t ha t 'su se r 2 1 03from wit hi nconta iner d < p edro nis > Ch ipaca : any reasonnot  toc han ge.Fu ll al read y?  just  moresprea dtests breaking?  orsomething  el se 
<j oe dborg >  jdstr and : l ike wit h the p i vot  r o o t  s tuff
<Chipaca> ped ro n i s:  no reas on
<Ch i pa ca >  pedroni s:  oh  wai t ,  youmean th e implem entati o n? 
< pedroni s>  Chipa ca : y es<jdst r and>  kjack al, joed borg: I need to stud y  the linkerdi ss u e .n np i s,shall we sa y, p r oble mati c  a tmf or al l the  L S Ms (including apparmor )<pedro nis>it's used onl y in error s a faict
<C hipa c a> pedronis: I th ink i t'll break some thi ngs w ithout t he patch< C hipaca>let  me  ch eck t ho ugh
<joedborg > jdst ra nd: i i mag ine the re' s s ome thi ng  been don e to the  d oc ke rsna p toa llow tha t<pe dr oni s> Ch i paca:afaiseeal lu sag es arei nc m d/sn ap /e rror .go 
< pedro nis> Chi paca: t his is Fu ll, notCl ea n
<Chip aca> pedronis :that's usa ge  of .Full, u sage ofcanon(ical)ize are in s n apstate 
<p edron is>I don't s eeFull i n s n apstat e
<ped ronis >(Im i ght h a v erem ov ed it myse l f  at  some  p oint , don't  know, I don't see itanymore)
<Chi pac a> p e d ro nis :  m y  qu es t ion i s what happensif you do-- c ha nnel=//foo / /,sh ut down  snapd, resta r t withthe new o ne that
cri-containerd.apparmor.d"`
<kjackal> jdstrand:_try this:_sudo microk8s.kubectl apply -f_ /var/snap/microk8s/current/testcfgmount.yaml
<jdstrand>_joedborg:_is it_possible_to intercept that_'runAsUser: 2103' bit_and remove it/make it_'0'?
<joedborg> jdstrand: it_might_be possible, but would probably mean no cross compatibility with running clusters
<Chipaca> zyga: I_had_my hand_on_"close_window" before mvo finished saying_"weird users of qemu"
 *_Chipaca stays_well away
<joedborg> jdstrand: just FYI, that's user 2103_from_within containerd
<pedronis> Chipaca:_any reason not to change.Full already? just more spread_tests breaking? or something else
<joedborg> jdstrand:_like with the_pivot_root_stuff
<Chipaca> pedronis: no reason
<Chipaca>_pedronis: oh wait, you mean the_implementation?
<pedronis> Chipaca: yes
<jdstrand> kjackal, joedborg: I_need to study the linkerd issue. nnp_is, shall we say, problematic atm_for all the LSMs (including_apparmor)
<pedronis> it's_used only in errors afaict
<Chipaca>_pedronis: I think_it'll break_some things without_the patch
<Chipaca> let me check though
<joedborg>_jdstrand: i imagine_there's something been done to the_docker_snap to allow_that
<pedronis>_Chipaca:_afai see_all usages are_in_cmd/snap/error.go
<pedronis> Chipaca:_this_is Full, not Clean
<Chipaca> pedronis: that's_usage_of.Full, usage of canon(ical)ize are in snapstate
<pedronis>_I don't see Full_in_snapstate
<pedronis> (I might have_removed it myself at some_point, don't know, I don't see_it anymore)
<Chipaca>_pedronis: my_question is what happens if you do --channel=//foo//, shut down snapd,restart_with the new one that