Amazon recommends using ec2-user (with passwordless sudo) for EC2 images. That's what Fedora has been doing. Do we want to continue this? Arguments:
A. It doesn't really provide any added security, but does add complication. Additionally, normal "don't run as root" advice is less important since cloud instances should be ephemeral and recreatable.
B. But, consistency.
What's our SIG consensus here?
Other points:
- We're making images for EC2 and for other cloud systems as well. 'ec2-user' seems particularly silly on, say, OpenStack. - We could use ec2-user and something else (including just root) on the generic images. - We should decide this really fast because it's already past the last minute; default is to just stay with ec2-user for F18 and revisit for F19.
On Fri, Dec 14, 2012 at 6:12 PM, Matthew Miller mattdm@fedoraproject.org wrote:
Amazon recommends using ec2-user (with passwordless sudo) for EC2 images. That's what Fedora has been doing. Do we want to continue this? Arguments:
A. It doesn't really provide any added security, but does add complication. Additionally, normal "don't run as root" advice is less important since cloud instances should be ephemeral and recreatable.
B. But, consistency.
What's our SIG consensus here?
Other points:
- We're making images for EC2 and for other cloud systems as well. 'ec2-user' seems particularly silly on, say, OpenStack.
- We could use ec2-user and something else (including just root) on the generic images.
- We should decide this really fast because it's already past the last minute; default is to just stay with ec2-user for F18 and revisit for F19.
I don't like that too, but I think we could leave as is for now
------------
Itamar Reis Peixoto
On 12/14/2012 01:12 PM, Matthew Miller wrote:
Amazon recommends using ec2-user (with passwordless sudo) for EC2 images. That's what Fedora has been doing. Do we want to continue this? Arguments:
A. It doesn't really provide any added security, but does add complication. Additionally, normal "don't run as root" advice is less important since cloud instances should be ephemeral and recreatable.
B. But, consistency.
What's our SIG consensus here?
Other points:
- We're making images for EC2 and for other cloud systems as well.
I know we're doing ec2. what are the other image types?
'ec2-user' seems particularly silly on, say, OpenStack.
- We could use ec2-user and something else (including just root) on the generic images.
- We should decide this really fast because it's already past the last minute; default is to just stay with ec2-user for F18 and revisit for F19.
On 14.12.2012 20:12, Matthew Miller wrote:
Amazon recommends using ec2-user (with passwordless sudo) for EC2 images. That's what Fedora has been doing. Do we want to continue this? Arguments:
A. It doesn't really provide any added security, but does add complication. Additionally, normal "don't run as root" advice is less important since cloud instances should be ephemeral and recreatable.
B. But, consistency.
What's our SIG consensus here?
Other points:
- We're making images for EC2 and for other cloud systems as well. 'ec2-user' seems particularly silly on, say, OpenStack.
- We could use ec2-user and something else (including just root) on
the generic images.
- We should decide this really fast because it's already past the
last minute; default is to just stay with ec2-user for F18 and revisit for F19.
In one of my EL6 images for Openstack I've added an ec2-user with same uid,gid and homedir as root, works fine, not sure if it's up to anyone else's standards, though.
On Fri, Dec 14, 2012 at 01:32:35PM -0700, Robyn Bergeron wrote:
- We're making images for EC2 and for other cloud systems as well.
I know we're doing ec2. what are the other image types?
A downloadable one which will work in OpenStack, Eucalyptus, CloudStack, OpenNebula and for that matter as a simple KVM guest if you like.
It'd be _nice_ if this were consistent with the Amazon EC2 image.
And, when Rackspace makes user-uploadable images a thing, we want that too.
Matthew Miller (mattdm@fedoraproject.org) said:
On Fri, Dec 14, 2012 at 01:32:35PM -0700, Robyn Bergeron wrote:
- We're making images for EC2 and for other cloud systems as well.
I know we're doing ec2. what are the other image types?
A downloadable one which will work in OpenStack, Eucalyptus, CloudStack, OpenNebula and for that matter as a simple KVM guest if you like.
<cloud n00b>
What format is this, and how is it converted to/from a EC2 (or even bare-metal) image?
</cloud n00b>
Bill
On 12/14/2012 03:12 PM, Matthew Miller wrote:
Amazon recommends using ec2-user (with passwordless sudo) for EC2 images. That's what Fedora has been doing. Do we want to continue this? Arguments:
A. It doesn't really provide any added security, but does add complication. Additionally, normal "don't run as root" advice is less important since cloud instances should be ephemeral and recreatable.
B. But, consistency.
Fedora can of course do its own thing, but Ubuntu, Amazon Linux, future RHELs, and other distros use ec2-user. This lines up with the EC2 documentation as well. I'd discourage changing it just because we can.
What's our SIG consensus here?
Other points:
- We're making images for EC2 and for other cloud systems as well. 'ec2-user' seems particularly silly on, say, OpenStack.
- We could use ec2-user and something else (including just root) on the generic images.
Fair points.
- We should decide this really fast because it's already past the last minute; default is to just stay with ec2-user for F18 and revisit for F19.
+1
- Jay
On Fri, Dec 14, 2012 at 1:40 PM, Matthew Miller mattdm@fedoraproject.orgwrote:
On Fri, Dec 14, 2012 at 01:32:35PM -0700, Robyn Bergeron wrote:
- We're making images for EC2 and for other cloud systems as well.
I know we're doing ec2. what are the other image types?
A downloadable one which will work in OpenStack, Eucalyptus, CloudStack, OpenNebula and for that matter as a simple KVM guest if you like.
So I read that as "we are currently making images for ec2 AND currently making images for other cloud systems as well (presumably as part of the release engineering process" .... which is what I meant by "what are the other images types" - are they qcow2? raw? ???? But it sonds like we have none because it sounds like there is not actually a decision made. Yes?
It'd be _nice_ if this were consistent with the Amazon EC2 image.
And, when Rackspace makes user-uploadable images a thing, we want that too.
-- Matthew Miller ☁☁☁ Fedora Cloud Architect ☁☁☁ < mattdm@fedoraproject.org> _______________________________________________ cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud
On Fri, Dec 14, 2012 at 02:04:40PM -0700, Robyn Bergeron wrote:
So I read that as "we are currently making images for ec2 AND currently making images for other cloud systems as well (presumably as part of the release engineering process" .... which is what I meant by "what are the other images types" - are they qcow2? raw? ???? But it sonds like we have none because it sounds like there is not actually a decision made. Yes?
Ohhhhh. Sorry.
I think we are decided based on earlier conversations that they will be provided as both qcow2 and raw.
(Eucalyptus can't digest qcow2.) And I'm afraid they will have to be compressed because there's no reasonable way to make them a downloadable yet useful size.
On 12/14/2012 03:12 PM, Matthew Miller wrote:
Amazon recommends using ec2-user (with passwordless sudo) for EC2 images. That's what Fedora has been doing. Do we want to continue this? Arguments:
A. It doesn't really provide any added security, but does add complication. Additionally, normal "don't run as root" advice is less important since cloud instances should be ephemeral and recreatable.
B. But, consistency.
What's our SIG consensus here?
Other points:
- We're making images for EC2 and for other cloud systems as well. 'ec2-user' seems particularly silly on, say, OpenStack.
- We could use ec2-user and something else (including just root) on the generic images.
- We should decide this really fast because it's already past the last minute; default is to just stay with ec2-user for F18 and revisit for F19.
I'd suggests "cloud-user".
On Fri, Dec 14, 2012 at 4:08 PM, Matthew Miller mattdm@fedoraproject.org wrote:
On Fri, Dec 14, 2012 at 02:04:40PM -0700, Robyn Bergeron wrote:
So I read that as "we are currently making images for ec2 AND currently making images for other cloud systems as well (presumably as part of the release engineering process" .... which is what I meant by "what are the other images types" - are they qcow2? raw? ???? But it sonds like we have none because it sounds like there is not actually a decision made. Yes?
Ohhhhh. Sorry.
I think we are decided based on earlier conversations that they will be provided as both qcow2 and raw.
(Eucalyptus can't digest qcow2.) And I'm afraid they will have to be compressed because there's no reasonable way to make them a downloadable yet useful size.
VHD and VMDK might also be useful formats.
--David
On Fri, Dec 14, 2012 at 1:00 PM, Jay Greguske jgregusk@redhat.com wrote:
On 12/14/2012 03:12 PM, Matthew Miller wrote:
Amazon recommends using ec2-user (with passwordless sudo) for EC2 images. That's what Fedora has been doing. Do we want to continue this? Arguments:
A. It doesn't really provide any added security, but does add complication. Additionally, normal "don't run as root" advice is less important since cloud instances should be ephemeral and recreatable.
B. But, consistency.
Fedora can of course do its own thing, but Ubuntu, Amazon Linux, future RHELs, and other distros use ec2-user. This lines up with the EC2 documentation as well. I'd discourage changing it just because we can.
Some historical info: since our first cloud image targeted EC2, we looked at the EC2 documentation and other distros, most of which tended toward ec2-user, so we went with that.
What's our SIG consensus here?
Other points:
- We're making images for EC2 and for other cloud systems as well. 'ec2-user' seems particularly silly on, say, OpenStack.
- We could use ec2-user and something else (including just root) on the generic images.
Fair points.
If we end up with One Image to Rule Them All at some point, I think using something more generic is fair. We could probably get pretty close with some fine-tuning. Just not for F18; I suspect we're a little late for that kind of churn.
- We should decide this really fast because it's already past the last minute; default is to just stay with ec2-user for F18 and revisit for F19.
+1
+1. This is an excellent time to discuss plans for F19 images, not so much F18 images.
-- Garrett Holmstrom
On Fri, Dec 14, 2012 at 06:27:41PM -0800, Garrett Holmstrom wrote:
If we end up with One Image to Rule Them All at some point, I think using something more generic is fair. We could probably get pretty close with some fine-tuning. Just not for F18; I suspect we're a little late for that kind of churn.
Agreed. But do you think we should use ec2-user by default in the _non_ Amazon images for F18 too?
On Fri, Dec 14, 2012 at 1:00 PM, Jay Greguske jgregusk@redhat.com wrote:
On 12/14/2012 03:12 PM, Matthew Miller wrote:
Amazon recommends using ec2-user (with passwordless sudo) for EC2 images. That's what Fedora has been doing. Do we want to continue this?
Arguments:
A. It doesn't really provide any added security, but does add
complication.
Additionally, normal "don't run as root" advice is less important
since
cloud instances should be ephemeral and recreatable.
B. But, consistency.
Fedora can of course do its own thing, but Ubuntu, Amazon Linux, future RHELs, and other distros use ec2-user. This lines up with the EC2 documentation as well. I'd discourage changing it just because we can.
Well, not exactly, ubuntu lucid in aws uses 'ubuntu', both 'cloud-user' or even 'fedora would be generic enough... in my opinion.
What's our SIG consensus here?
Other points:
- We're making images for EC2 and for other cloud systems as well. 'ec2-user' seems particularly silly on, say, OpenStack.
- We could use ec2-user and something else (including just root) on the generic images.
Fair points.
- We should decide this really fast because it's already past the last minute; default is to just stay with ec2-user for F18 and revisit for F19.
+1
- Jay
cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud
On 12/14/2012 09:12 PM, Matthew Miller wrote:
Amazon recommends using ec2-user (with passwordless sudo) for EC2 images. That's what Fedora has been doing. Do we want to continue this? Arguments:
A. It doesn't really provide any added security, but does add complication. Additionally, normal "don't run as root" advice is less important since cloud instances should be ephemeral and recreatable.
I think the security concern is: there are a lot of things user can do without having root privileges. Providing him with root access by default leads to unreasonable using it for everything. Using 'sudo' for privileged commands only looks better.
On 12/14/2012 04:00 PM, Jay Greguske wrote:
On 12/14/2012 03:12 PM, Matthew Miller wrote:
Amazon recommends using ec2-user (with passwordless sudo) for EC2 images. That's what Fedora has been doing. Do we want to continue this? Arguments:
A. It doesn't really provide any added security, but does add complication. Additionally, normal "don't run as root" advice is less important since cloud instances should be ephemeral and recreatable.
B. But, consistency.
Fedora can of course do its own thing, but Ubuntu, Amazon Linux, future RHELs, and other distros use ec2-user. This lines up with the EC2 documentation as well. I'd discourage changing it just because we can.
What's our SIG consensus here?
Other points:
- We're making images for EC2 and for other cloud systems as well. 'ec2-user' seems particularly silly on, say, OpenStack.
- We could use ec2-user and something else (including just root) on the generic images.
Fair points.
- We should decide this really fast because it's already past the last minute; default is to just stay with ec2-user for F18 and revisit for F19.
+1
- Jay
cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud
Amazon of course uses ec2-user, ec2 is an Amazon product.
Ubuntu initially focused on ec2 so ec2-user made sense.
Multiple back-end support is a core principal for Red Hat cloud solutions. Using a user name which reflects a proprietary offering seems counter to that.
Again, I suggest "cloud-user".
Joe VLcek
On Fri, Dec 14, 2012 at 04:14:01PM -0500, David Nalley wrote:
(Eucalyptus can't digest qcow2.) And I'm afraid they will have to be compressed because there's no reasonable way to make them a downloadable yet useful size.
VHD and VMDK might also be useful formats.
Yeah. As I understand it, CloudStack uses different formats depending on the hypervisor used, right?
On Mon, Dec 17, 2012 at 09:27:02AM -0500, jvlcek wrote:
Multiple back-end support is a core principal for Red Hat cloud solutions. Using a user name which reflects a proprietary offering seems counter to that.
And, while we're all very fond of Red Hat's principals for cloud solutions, it happens that the same applies to Fedora as well. Possibly even more so.
Matthew Miller (mattdm@fedoraproject.org) said:
On Fri, Dec 14, 2012 at 04:14:01PM -0500, David Nalley wrote:
(Eucalyptus can't digest qcow2.) And I'm afraid they will have to be compressed because there's no reasonable way to make them a downloadable yet useful size.
VHD and VMDK might also be useful formats.
Yeah. As I understand it, CloudStack uses different formats depending on the hypervisor used, right?
Is it best to produce one image and scripts for post-processing it into the appropriate formats, or to simply produce them all?
Bill
On Mon, Dec 17, 2012 at 01:48:28PM -0500, Bill Nottingham wrote:
Yeah. As I understand it, CloudStack uses different formats depending on the hypervisor used, right?
Is it best to produce one image and scripts for post-processing it into the appropriate formats, or to simply produce them all?
I don't know. There's a trade-off between, on the one hand, being immediately useful and, on the other, shipping the same bits around in different packages.
On 2012-12-17 10:48, Bill Nottingham wrote:
Matthew Miller (mattdm@fedoraproject.org) said:
On Fri, Dec 14, 2012 at 04:14:01PM -0500, David Nalley wrote:
(Eucalyptus can't digest qcow2.) And I'm afraid they will have to be compressed because there's no reasonable way to make them a downloadable yet useful size.
VHD and VMDK might also be useful formats.
Yeah. As I understand it, CloudStack uses different formats depending on the hypervisor used, right?
Is it best to produce one image and scripts for post-processing it into the appropriate formats, or to simply produce them all?
Unless the various formats are fundamentally different, if we're looking for portability then I'd be inclined to teach people how to package a common format like a raw filesystem image into something cloud-specific, then publish the common format. If there's enough space/time/demand then it could also be worth publishing multiple formats to make things more convenient.
-- Garrett Holmstrom
On Mon, Dec 17, 2012 at 08:57:47PM -0800, Garrett Holmstrom wrote:
Is it best to produce one image and scripts for post-processing it into the appropriate formats, or to simply produce them all?
Unless the various formats are fundamentally different, if we're looking for portability then I'd be inclined to teach people how to package a common format like a raw filesystem image into something cloud-specific, then publish the common format. If there's enough space/time/demand then it could also be worth publishing multiple formats to make things more convenient.
So, from the earlier conversation:
qcow2 because we can make a < 700MB image which can go uncompressed into the mirror system, ready to use.
raw (compressed) because it's a handy generic format people can easily work with.