feat: Support running VS Code in ubi9-based containers

[RomanNikitenko]

Some adaptation is required for the downstream, so please do NOT merge the current PR - I'm going to provide the corresponding changes to the downstream while the current PR is under review.

What does this PR do?

The current solution works for ubi8 and ubi9-based containers, see How to test this PR section.

What issues does this PR fix?

eclipse-che/che#21778

How to test this PR?

I tested it for the following images:

Image	Workspace starts	Link to start a workspace
quay.io/devfile/universal-developer-image:ubi8-latest	+	click here
registry.access.redhat.com/ubi8	+	click here
registry.access.redhat.com/ubi8/ubi:8.8-1032.1692772289	+	click here
registry.access.redhat.com/ubi8/openjdk-11:latest	+	click here
registry.access.redhat.com/ubi8/nodejs-16:1-139	+	click here
registry.access.redhat.com/ubi8/nodejs-18:1-32	+	click here
registry.access.redhat.com/ubi9	+	click here
registry.access.redhat.com/ubi9/ubi:9.3-1476	+	click here
registry.access.redhat.com/ubi9/nodejs-18:1-84	+	click here
registry.access.redhat.com/ubi9/python-39:1-161	+	click here
registry.access.redhat.com/ubi9/go-toolset:1.19.13-4.1697647145	+	click here
registry.access.redhat.com/ubi9/openjdk-17:1.17-1	+	click here

[github-actions]

Click here to review and test in web IDE:

[github-actions]

Pull Request Dev image published:
👉 quay.io/che-incubator-pull-requests/che-code-dev:pr-317-dev-amd64

[github-actions]

Pull Request Dev image published:
👉 quay.io/che-incubator-pull-requests/che-code-dev:pr-317-dev-amd64

[github-actions]

Pull Request Dev image published:
👉 quay.io/che-incubator-pull-requests/che-code-dev:pr-317-dev-amd64

[github-actions]

Pull Request Dev image published:
👉 quay.io/che-incubator-pull-requests/che-code-dev:pr-317-dev-amd64

[github-actions]

Pull Request Dev image published:
👉 quay.io/che-incubator-pull-requests/che-code-dev:pr-317-dev-amd64

[github-actions]

Pull Request Che-Code image published:
👉 quay.io/che-incubator-pull-requests/che-code:pr-317-amd64

[RomanNikitenko]

@l0rd
I've adapted the corresponding jobs => PR Checkgithub action now passes successfully and the image contains all required changes.

So now it's possible to test starting VS Code for both: ubi8 and ubi9 containers using that image.

[l0rd]

When I try with this image (quay.io/mloriedo/cloud-dev-images:ubi8) I get:

/checode/entrypoint-volume.sh: line 36: openssl: command not found
OpenSSL major version is .

Full entrypoint-logs.txt

cat entrypoint-logs.txt 
total 4
drwxrwsrwx. 6 root       1001110000  138 Dec 13 17:22 .
dr-xr-xr-x. 1 root       root        157 Dec 13 17:22 ..
drwxr-sr-x. 2 1001110000 1001110000   26 Dec 13 17:22 bin
drwxr-sr-x. 4 1001110000 1001110000   30 Dec 13 17:22 checode-linux-libc
drwxr-sr-x. 8 1001110000 1001110000  151 Dec 13 17:22 checode-linux-musl
-rw-rw-rw-. 1 1001110000 1001110000    0 Dec 13 17:22 entrypoint-logs.txt
-rwxr-xr-x. 1 1001110000 1001110000 1799 Dec 13 17:22 entrypoint-volume.sh
drwxr-sr-x. 3 1001110000 1001110000   18 Dec 13 17:22 remote
time="2023-12-13T17:22:28Z" level=info msg="Default 'info' log level is applied"
/checode/entrypoint-volume.sh: line 36: openssl: command not found
OpenSSL major version is .
Error: Unsupported OpenSSL major version .
time="2023-12-13T17:22:28Z" level=info msg="Exec containers configuration:"
time="2023-12-13T17:22:28Z" level=info msg="==> Debug level info"
time="2023-12-13T17:22:28Z" level=info msg="==> Application url 0.0.0.0:3333"
time="2023-12-13T17:22:28Z" level=info msg="==> Absolute path to folder with static resources "
time="2023-12-13T17:22:28Z" level=info msg="==> Use bearer token: false"
time="2023-12-13T17:22:28Z" level=info msg="==> Pod selector: controller.devfile.io/devworkspace_id=workspacef54f20d66d2f4653"
time="2023-12-13T17:22:28Z" level=info msg="==> Idle timeout: 3h0m0s"
time="2023-12-13T17:22:28Z" level=info msg="==> Run timeout: 24h0m0s"
time="2023-12-13T17:22:28Z" level=info msg="==> Stop retry period: 10s"
[GIN-debug] [WARNING] Creating an Engine instance with the Logger and Recovery middleware already attached.

[GIN-debug] [WARNING] Running in "debug" mode. Switch to "release" mode in production.
 - using env:   export GIN_MODE=release
 - using code:  gin.SetMode(gin.ReleaseMode)

[GIN-debug] GET    /connect                  --> main.main.func2 (3 handlers)
[GIN-debug] GET    /attach/:id               --> main.main.func3 (3 handlers)
[GIN-debug] POST   /exec/config              --> main.main.func4 (3 handlers)
[GIN-debug] POST   /exec/init                --> main.main.func5 (3 handlers)
[GIN-debug] POST   /activity/tick            --> main.main.func6 (3 handlers)
[GIN-debug] GET    /healthz                  --> main.main.func7 (3 handlers)
⇩ Registered RPCRoutes:

Json-rpc MachineExec Routes:
✓ create
✓ check
✓ resize
✓ listContainers
time="2023-12-13T17:22:28Z" level=info msg="Activity tracker is run and workspace will be stopped in 3h0m0s if there is no activity"
time="2023-12-13T17:22:28Z" level=info msg="Run idle manager is running. The workspace will be stopped in 24h0m0s"
[GIN-debug] Listening and serving HTTP on 0.0.0.0:3333

Note that using this same image works with current checode. And that my expectation would be that it works on the UBI9 version of that too.

[RomanNikitenko]

@l0rd
there is no openssl command in the container:

I'm not sure why it's absent, but anyway - thank you very much for reporting this problem - I'm going to look for a better way detecting openssl version for such images...

[l0rd]

I'm not sure why it's absent, but anyway

This is the default UBI8 image 🤷 , yes I guess you will have to find another check.

[RomanNikitenko]

@l0rd
I tested it for ubi9 based image and for quay.io/devfile/universal-developer-image:ubi8-latest

it worked well:

also it worked for ubi8/nodejs that we use as a base image to prepare Che-Code assembly:

it's still draft PR, so, as I mentioned above - thanks for testing and reporting it!

[github-actions]

Pull Request Dev image published:
👉 quay.io/che-incubator-pull-requests/che-code-dev:pr-317-dev-amd64

[github-actions]

Pull Request Che-Code image published:
👉 quay.io/che-incubator-pull-requests/che-code:pr-317-amd64

[github-actions]

Pull Request Dev image published:
👉 quay.io/che-incubator-pull-requests/che-code-dev:pr-317-dev-amd64

[github-actions]

Pull Request Dev image published:
👉 quay.io/che-incubator-pull-requests/che-code-dev:pr-317-dev-amd64

[github-actions]

Pull Request Che-Code image published:
👉 quay.io/che-incubator-pull-requests/che-code:pr-317-amd64

[azatsarynnyy]

@azatsarynnyy I think we should add Required label for the following jobs after merging the current PR:

Do you have permissions to do it?

@RomanNikitenko yes, we can update the repo settings - I have the required permissions.
BTW, do you think that having the assemble check the only one that is required should be enough, as it already depends on other build checks?

[github-actions]

Pull Request Dev image published:
👉 quay.io/che-incubator-pull-requests/che-code-dev:pr-317-dev-amd64

[github-actions]

Pull Request Che-Code image published:
👉 quay.io/che-incubator-pull-requests/che-code:pr-317-amd64

[RomanNikitenko]

@ibuziuk
I guess we should test all devfiles from the https://registry.devfile.io/viewer before merging the current PR.
I expect that a workspace should start for all ubi8 and ubi9-based devfiles.

[ibuziuk]

@musienko-maxim could you please follow up with Roman on the verification? Basically, all the devfiles from https://registry.devfile.io/viewer / https://registry.devfile.io/index should work

[musienko-maxim]

All devsamples have been tested on DogFooding instance. This was commented on here: https://issues.redhat.com/browse/CRW-5634. Short conclusion:
We have a problem for 2 devfiles: WildFly Bootable Jar and Vert.x Java both devfiles use containers that are not ubi8/ubi9-based images. I think this PR is not affected on UBI based samples.

[RomanNikitenko]

I'm closing the current PR in favour of #324.
The difference is:

• the current PR downloads Node.js from the https://nodejs.org
• PR-324 relies on Node.js that provided by registry.access.redhat.com/ubi9/nodejs-18 + provides libbrotli related files to user's container

It was decided to use PR-324 approach, as it simplifies downstream project support