1. Documentation
    2. history bug_report picture_as_pdf
×

Accessing faster builds with /dev/fuse

You can configure your pods with the /dev/fuse device to access faster builds.

Configuring /dev/fuse on unprivileged pods

As an alternative to the virtual filesystem, you can configure the /dev/fuse device to the io.kubernetes.cri-o.Devices annotation to access faster builds within unprivileged pods. Using /dev/fuse is secure, efficient, and scalable, and allows unprivileged users to mount an overlay filesystem as if the unprivileged pod was privileged.

Procedure

  1. Create the pod.

    $ oc exec -ti no-priv -- /bin/bash
    $ cat >> Dockerfile <<EOF
FROM registry.access.redhat.com/ubi9
EOF
    $ podman build .

  2. Implement /dev/fuse by adding the /dev/fuse device to the io.kubernetes.cri-o.Devices annotation.

    io.kubernetes.cri-o.Devices: "/dev/fuse"

    For example:

    apiVersion: v1
kind: Pod
metadata:
  name: podman-pod
  annotations:
    io.kubernetes.cri-o.Devices: "/dev/fuse"

  3. Configure the /dev/fuse device in your pod specifications.

    spec:
  containers:
  - name: podman-container
    image: quay.io/podman/stable
    args:
    - sleep
    - "1000000"
    securityContext:
      runAsUser: 1000