Does --disablerepo option work if used in a Containerfile?

[oglok]

I'm trying to do a simple example of adding libreswan to a base RHEL image, and I get conflicting sources:

STEP 1/2: FROM quay.io/oglok/rhel9.2-base:latest
STEP 2/2: RUN rpm-ostree install --disablerepo="*" https://rpmfind.net/linux/centos-stream/9-stream/AppStream/x86_64/os/Packages/libreswan-4.12-1.el9.x86_64.rpm     https://rpmfind.net/linux/centos-stream/9-stream/AppStream/x86_64/os/Packages/ldns-1.7.1-11.el9.x86_64.rpm &&     ostree container commit
Downloading https://rpmfind.net/linux/centos-stream/9-stream/AppStream/x86_64/os/Packages/libreswan-4.12-1.el9.x86_64.rpm...done
Downloading https://rpmfind.net/linux/centos-stream/9-stream/AppStream/x86_64/os/Packages/ldns-1.7.1-11.el9.x86_64.rpm...done

(rpm-ostree install:2): librhsm-WARNING **: 10:52:09.339: Found 0 entitlement certificates

(rpm-ostree install:2): librhsm-WARNING **: 10:52:09.340: Found 0 entitlement certificates
No enabled rpm-md repositories.
Importing rpm-md...done
Resolving dependencies...done
error: Could not depsolve transaction; 2 problems detected:
 Problem 1: cannot install both ldns-1.7.1-11.el9.x86_64 from @commandline and ldns-1.7.1-11.el9.x86_64 from @System
  - conflicting requests
 Problem 2: cannot install both libreswan-4.12-1.el9.x86_64 from @commandline and libreswan-4.12-1.el9.x86_64 from @System
  - conflicting requests
Error: building at STEP "RUN rpm-ostree install --disablerepo="*" https://rpmfind.net/linux/centos-stream/9-stream/AppStream/x86_64/os/Packages/libreswan-4.12-1.el9.x86_64.rpm     https://rpmfind.net/linux/centos-stream/9-stream/AppStream/x86_64/os/Packages/ldns-1.7.1-11.el9.x86_64.rpm &&     ostree container commit": while running runtime: exit status 1

The Containerfile is as simple as:

FROM quay.io/oglok/rhel9.2-base:latest

RUN rpm-ostree install --disablerepo="*" https://rpmfind.net/linux/centos-stream/9-stream/AppStream/x86_64/os/Packages/libreswan-4.12-1.el9.x86_64.rpm \
    https://rpmfind.net/linux/centos-stream/9-stream/AppStream/x86_64/os/Packages/ldns-1.7.1-11.el9.x86_64.rpm && \
    ostree container commit

[jmarrero]

what is the rpm-ostree --version ? This is only available on v2023.3 and up

[oglok]

STEP 1/3: FROM quay.io/oglok/rhel9.2-base:latest
STEP 2/3: RUN rpm-ostree --version
rpm-ostree:
 Version: '2023.3'
 Git: 387daa790d6302a285fcf45b53a55c4f3d651bc7
 Features:
  - rust
  - compose
  - container
  - rhsm
--> 4fe119d06ac

[cgwalters]

Hmm it looks to me like the logic added here is basically a no-op right?

https://github.com/coreos/rpm-ostree/pull/4346/files#diff-1689a94aa01d8ee1fcf35746240552d40a7197a8067a8cf2bacb5af703c3ec9aR819-R826

We'd need to do something like this:

diff --git a/rust/src/treefile.rs b/rust/src/treefile.rs
index e292fedf..01a71a20 100644
--- a/rust/src/treefile.rs
+++ b/rust/src/treefile.rs
@@ -813,6 +813,7 @@ impl Treefile {
                 repo
             ));
         }
+        self.parsed.base.repos = None;
         Ok(())
     }
 

or...actually I'm not totally sure that'd work because the logic in the core does this:

 /* NB: missing "repos" --> let libdnf figure it out for itself (we're likely doing a
       * client-side compose where we want to use /etc/yum.repos.d/) */

So we'd probably need to do something like set a boolean in the treefile to say "really disable all repos" and then honor that in rpmostree-core.cxx

[jmarrero]

I am inspecting the base image and it looks like it already has libreswan and ldns which would mean that if you want to replace it you need to use rpm-ostree override replace, which also does not have --disablerepo option.

STEP 1/3: FROM quay.io/oglok/rhel9.2-base:latest
STEP 2/3: RUN rpm -qa libreswan
libreswan-4.12-1.el9.x86_64
--> 761e944a22e9
STEP 3/3: RUN rpm -qa ldns
ldns-1.7.1-11.el9.x86_64
COMMIT

But yeah we need to add some fixes here anyway.
Sadly I can't seem to override replace either these packages...
I opened this issue: #4670 to look more into these.