Skip to content

vm-less and daemon-less ELBE build via container #482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
koalo wants to merge 13 commits into
base: master
Choose a base branch
from
Open

vm-less and daemon-less ELBE build via container #482

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
be69ac8
elbepack: add VM-free alternative to elbe initvm submit
koalo Jul 1, 2026
76f1917
elbepack: exclude initvm packages for container builds
koalo Jul 20, 2026
a81cea7
elbepack: thread gnupg_home through repo and signing helpers
koalo Jul 28, 2026
54c6114
add minimal VM-free ELBE build container
koalo Jul 1, 2026
4a31760
efilesystem: shellhelper: move _Mount from imgutils.py to shellhelper.py
koalo Jul 27, 2026
e398761
efilesystem: rbind pseudo filesystems instead of creating them from s…
koalo Jul 27, 2026
1edb61c
elbepack: imgutils: do not depend on udev if it does not exist
koalo Jul 30, 2026
c3359a1
elbepack: imgutils: create by-uuid symlinks for device nodes created …
koalo Jul 30, 2026
3793bb6
container: avoid the need for explicitly adding CAP_SYS_ADMIN
koalo Jul 25, 2026
5b96212
elbepack: localbuildaction: check the need for rootful container
koalo Jul 24, 2026
d05b203
test: use /var/tmp instead of /tmp for pytest
koalo Jul 28, 2026
511b2ae
elbepack: tests: introduce build_driver abstraction for xml tests
koalo Jul 20, 2026
7200369
elbepack: tests: provide test for build without initvm
koalo Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
.git
.mypy_cache
.pytest_cache
*.deb
*.buildinfo
*.changes
3 changes: 3 additions & 0 deletions conftest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,9 @@ def pytest_configure(config):
if warnings:
os.environ.setdefault('PYTHONWARNINGS', ' '.join(warnings))

# use /var/tmp to avoid filling up the RAM with large build artifacts
os.environ.setdefault('TMPDIR', '/var/tmp')

@t-8ch t-8ch Aug 25, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is quite specific to Debian, let me think about something more generic.


def pytest_collection_modifyitems(config, items):
if config.getoption('--runslow'):
Expand Down
38 changes: 38 additions & 0 deletions contrib/containerfile/Containerfile
View file
Open in desktop

@t-8ch t-8ch Aug 25, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would anybody really stick to the vmfull container?

@koalo koalo Aug 25, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Honestly, I tried, but am unable to understand what the contrib/containerfile/Containerfile is actually used for. So I did not want to break anyones obscure use case. But if that is fine for you, I am happy to drop that and replace it with my Containerfile.

@t-8ch t-8ch Aug 31, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we avoid the whole container thing for now and just do the root-less builds from an ELBE source checkout?

@koalo koalo Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In principle, yes. But that requires the system to be set up exactly as ELBE requires it. Not sure if that is really feasible.

@koalo koalo Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It now replaces the previous containerfile
428953e

Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
# ELBE - Debian Based Embedded Rootfilesystem Builder
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2026 Linutronix GmbH

FROM debian:trixie-slim

USER root
ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update -y && \
apt-get upgrade -y && \
apt-get install -y --no-install-recommends \
ca-certificates \
elbe-archive-keyring \
tini

RUN echo 'deb [signed-by=/usr/share/keyrings/elbe-archive-keyring.gpg] http://debian.linutronix.de/elbe bullseye main' \
> /etc/apt/sources.list.d/elbe.list && \
apt-get update -y && \
apt-get install -y --no-install-recommends \
python3-elbe-daemon \
python3-elbe-soap \
python3-elbe-control \
locales && \
apt-get clean -y

RUN echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen

VOLUME [ "/build" ]

USER root
WORKDIR /build

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Use tini for reaping child processes.
ENTRYPOINT ["tini", "--", "/entrypoint.sh"]
67 changes: 0 additions & 67 deletions contrib/containerfile/Containerfile.in
View file
Open in desktop

This file was deleted.

59 changes: 59 additions & 0 deletions contrib/containerfile/Containerfile.local
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
# ELBE - Debian Based Embedded Rootfilesystem Builder
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2026 Linutronix GmbH

FROM debian:trixie-slim AS builder

USER root
ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update -y && \
apt-get install -y --no-install-recommends \
build-essential \
ca-certificates

WORKDIR /usr/src/elbe
COPY . .

RUN apt-get update -y && \
apt-get build-dep -y . && \
DEB_BUILD_OPTIONS=nocheck sphinxflags= dpkg-buildpackage -us -uc -b && \
mkdir -p /out && mv ../*.deb /out/

FROM debian:trixie-slim

USER root
ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update -y && \
apt-get install -y --no-install-recommends \
ca-certificates \
tini

COPY --from=builder /out/*.deb /tmp/local-debs/
RUN apt-get update -y && apt-get upgrade -y

RUN apt-get install -y --no-install-recommends \
locales \
/tmp/local-debs/elbe-schema_*.deb \
/tmp/local-debs/python3-elbe-common_*.deb \
/tmp/local-debs/python3-elbe-bin_*.deb \
/tmp/local-debs/python3-elbe-buildenv_*.deb \
/tmp/local-debs/python3-elbe-daemon_*.deb \
/tmp/local-debs/python3-elbe-soap_*.deb \
/tmp/local-debs/python3-elbe-control_*.deb && \
rm -rf /tmp/local-debs && \
apt-get clean -y

RUN echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen

VOLUME [ "/build" ]

USER root
WORKDIR /build

COPY contrib/containerfile/entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

# Use tini for reaping child processes.
ENTRYPOINT ["tini", "--", "/entrypoint.sh"]
65 changes: 13 additions & 52 deletions contrib/containerfile/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,16 @@
# ELBE - Debian Based Embedded Rootfilesystem Builder
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2015 Silvio Fricke <silvio.fricke@gmail.com>
# SPDX-FileCopyrightText: 2018 Linutronix GmbH
# SPDX-FileCopyrightText: 2026 Linutronix GmbH

IMAGENAME ?= elbe-devel-image
CONTAINERNAME ?= elbe-devel
KVMGID ?= $(shell ls -n /dev/kvm | awk '{ print $$4 }')
UID ?= $(shell id -u)
IMAGENAME ?= elbe-buildenv-image
CONTAINERNAME ?= elbe-buildenv

# Container engine to use. Defaults to podman if installed, else docker.
ENGINE ?= $(shell command -v podman >/dev/null 2>&1 && echo podman || echo docker)

# Common container run options
RUN_OPTS = \
--cap-add SYS_ADMIN \
--security-opt seccomp=unconfined \
--security-opt apparmor=unconfined \
--group-add kvm \
--device /dev/kvm \
--device /dev/fuse \
--rm \
--interactive \
--tty
Expand All @@ -32,51 +24,20 @@ ifeq ($(ENGINE),podman)
RUN_OPTS += --userns=keep-id
endif

# container commands
build:
test -c /dev/kvm || ( echo "/dev/kvm not found" && false )
test -c /dev/fuse || ( echo "/dev/fuse not found" && false )
test -n "$(KVMGID)" || ( echo "detecting groupid of /dev/kvm failed" && false )
sed -e "s#@KVMGID@#$(KVMGID)#g" \
-e "s#@USERID@#$(UID)#g" \
Containerfile.in > Containerfile
$(ENGINE) build --build-arg http_proxy=$(http_proxy) \
--build-arg https_proxy=$(https_proxy) \
--build-arg no_proxy=$(no_proxy) \
--no-cache \
-f Containerfile \
--network=slirp4netns \
-t $(IMAGENAME) .
rm Containerfile

start-devel:
$(ENGINE) ps | grep $(CONTAINERNAME)$$ || \
$(ENGINE) run --name $(CONTAINERNAME) \
-e http_proxy=$(http_proxy) \
-e https_proxy=$(https_proxy) \
-e no_proxy=$(no_proxy) \
-v $(realpath ../../.):/var/cache/elbe/devel -w /var/cache/elbe/devel \
$(RUN_OPTS) \
$(IMAGENAME)

start:
$(ENGINE) ps | grep $(CONTAINERNAME)$$ || \
$(ENGINE) run --name $(CONTAINERNAME) \
-e http_proxy=$(http_proxy) \
-e https_proxy=$(https_proxy) \
-e no_proxy=$(no_proxy) \
$(RUN_OPTS) \
$(IMAGENAME)

stop:
-$(ENGINE) stop $(CONTAINERNAME)

stoprm: stop
-$(ENGINE) rm $(CONTAINERNAME)

clean: stoprm
-$(ENGINE) rmi $(IMAGENAME)

connect: start
$(ENGINE) exec -tiu $(UID) $(CONTAINERNAME) /bin/bash
# Builds the elbe .deb packages from this checkout first
build-local:
$(ENGINE) build --build-arg http_proxy=$(http_proxy) \
--build-arg https_proxy=$(https_proxy) \
--build-arg no_proxy=$(no_proxy) \
--network=slirp4netns \
-f Containerfile.local \
-t $(IMAGENAME) ../..

.PHONY: build start stop stoprm clean connect
.PHONY: build build-local
48 changes: 0 additions & 48 deletions contrib/containerfile/README.md
View file
Open in desktop

This file was deleted.

20 changes: 20 additions & 0 deletions contrib/containerfile/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-3.0-or-later
# SPDX-FileCopyrightText: 2026 Linutronix GmbH
set -e

# Check if we already have CAP_SYS_ADMIN
# In that case we assume we are already running rootful,
# so no need for unshare, but this mode also enables usage
# of loop devices, so perform mknod to enable its usage.
capeff=$(grep '^CapEff:' /proc/self/status | cut -f2)
if [ $(( 0x$capeff & 0x200000 )) -ne 0 ]; then
i=0
while [ "$i" -lt 64 ]; do
[ -e "/dev/loop$i" ] || mknod -m 660 "/dev/loop$i" b 7 "$i" 2>/dev/null || true

@t-8ch t-8ch Aug 25, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we mount devtmpfs instead here, too?

@koalo koalo Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar reason as #482 (comment)
Even in the rootful case, I still wanted to encapsulate the build and only pass through what is really needed and in my understanding enabling devtmpfs requires more privileges than the container currently has.
But maybe you have a different approach in mind?

@t-8ch t-8ch Aug 31, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair enough. I'll have to play around with this actually.
For example I have no idea where /dev/loop-control is coming from currently.

@koalo koalo Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well... /dev/loop-control is not coming from anywhere at the moment... losetup apparently just falls back to scanning the /dev/loop* directly: https://github.com/util-linux/util-linux/blob/master/lib/loopdev.c#L1761

So it is working, but maybe not in the "modern" way. I guess I should pass through /dev/loop-control as well?

i=$((i + 1))
done
exec "$@"
fi

exec unshare --user --map-root-user --map-users=all --map-groups=all --mount -- "$@"
2 changes: 2 additions & 0 deletions debian/python3-elbe-common.install
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,9 @@ usr/lib/python3.*/*-packages/elbepack/initvm.py
usr/lib/python3.*/*-packages/elbepack/initvmaction.py
usr/lib/python3.*/*-packages/elbepack/isooptions.py
usr/lib/python3.*/*-packages/elbepack/licencexml.py
usr/lib/python3.*/*-packages/elbepack/localbuildaction.py
usr/lib/python3.*/*-packages/elbepack/log.py
usr/lib/python3.*/*-packages/elbepack/rootcheck.py
usr/lib/python3.*/*-packages/elbepack/packers.py
usr/lib/python3.*/*-packages/elbepack/paths.py
usr/lib/python3.*/*-packages/elbepack/pkgutils.py
Expand Down
1 change: 1 addition & 0 deletions debian/python3-elbe-control.install
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
usr/lib/python3.*/*-packages/elbepack/commands/build.py
Comment thread
t-8ch marked this conversation as resolved.
usr/lib/python3.*/*-packages/elbepack/commands/control.py
usr/lib/python3.*/*-packages/elbepack/commands/initvm.py
usr/lib/python3.*/*-packages/elbepack/commands/pbuilder.py
Expand Down
Loading
Loading