Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel > #112373

Re: Reviving schroot as used by sbuild

Show all headers | View raw

Hi Philipp,

Let me go into some detail that is tangential to the larger discussion.

On Mon, Jul 01, 2024 at 09:18:19AM +0200, Philipp Kern wrote:
> How well does this setup nest? I had a lot of trouble trying to run the
> unshare backend within an unprivileged container as setup by systemd-nspawn
> - mostly with device nodes. In the end I had to give up and replaced the
> container with a full-blown VM. I understand that some of the things compose
> a little if the submaps are set up correctly, with less IDs allocated to the
> nested child. Is there a way to make this work properly, or would you always
> run into setup issues with device nodes at this point?

Technically speaking, nesting is possible. The individual container
implementation may limit you, but that's an implementation limit and not
a fundamental one. I'm assuming that you want to nest a rootless
container in a rootless container as that tends to be the most difficult
one. Roughly speaking your unprivileged container wants access to your
user id and a 64k allocation of subuids. This applies to the nested
container. If your outer container maps two 64k ranges (one to 0 to
65535 and the other to whatever your user has in its contained
/etc/subuid), your contained user should actually be able to spawn a
podman container unless I am missing something important. Devices
usually are not a problem (for rootless containers) as you cannot create
them anyway so you end up bind mounting them and the bind mounting
technique nests well.

A typical Debian installation only allocates a single 64k range to each
user. Your first step here is growing that range or adding another one.
(Yes, you may have multiple lines for your user in /etc/subuid.) Then
the podman-run documentation hints at --uidmap and it says that you can
specify it multiple times to map multiple ranges. This is how you
construct your outer container. Then inside, nesting should just work.
Admittedly, I've not tried this.

The takeaway should be that if your outer container is constructed in
the right way, you should be able to nest other containers (e.g. podman,
mmdebstrap, sbuild unshare, ...) without issues. It's not like this just
works out of the box, but it should be feasible.

Helmut

Back to linux.debian.devel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Reviving schroot as used by sbuild Helmut Grohne <helmut@subdivi.de> - 2024-06-25 10:20 +0200
  Re: Reviving schroot as used by sbuild Johannes Schauer Marin Rodrigues <josch@debian.org> - 2024-06-25 11:40 +0200
  Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-25 15:10 +0200
    Re: Reviving schroot as used by sbuild Andrey Rakhmatullin <wrar@debian.org> - 2024-06-25 15:30 +0200
    Re: Reviving schroot as used by sbuild Faidon Liambotis <paravoid@debian.org> - 2024-06-25 15:30 +0200
    Re: Reviving schroot as used by sbuild Antonio Terceiro <terceiro@debian.org> - 2024-06-25 17:30 +0200
    Re: Reviving schroot as used by sbuild Russ Allbery <rra@debian.org> - 2024-06-25 18:40 +0200
      Re: Reviving schroot as used by sbuild Guillem Jover <guillem@debian.org> - 2024-06-25 18:50 +0200
        Re: Reviving schroot as used by sbuild Marco d'Itri <md@Linux.IT> - 2024-06-25 19:10 +0200
        Re: Reviving schroot as used by sbuild Russ Allbery <rra@debian.org> - 2024-06-25 19:30 +0200
          Re: Reviving schroot as used by sbuild Andrey Rakhmatullin <wrar@debian.org> - 2024-06-25 19:40 +0200
          Re: Reviving schroot as used by sbuild Russ Allbery <rra@debian.org> - 2024-06-25 19:50 +0200
          Re: Reviving schroot as used by sbuild PICCA Frederic-Emmanuel <frederic-emmanuel.picca@synchrotron-soleil.fr> - 2024-06-25 19:50 +0200
        Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-26 18:10 +0200
      Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-25 19:00 +0200
    Re: Reviving schroot as used by sbuild Helmut Grohne <helmut@subdivi.de> - 2024-06-25 19:00 +0200
      autopkgtest + podman user experience (Was: Re: Reviving schroot as  used by sbuild) Gioele Barabucci <gioele@svario.it> - 2024-06-25 20:20 +0200
        Re: autopkgtest + podman user experience (Was: Re: Reviving schroot  as used by sbuild) Paul Gevers <elbrus@debian.org> - 2024-06-25 22:20 +0200
      Re: Reviving schroot as used by sbuild Paul Gevers <elbrus@debian.org> - 2024-06-25 22:00 +0200
      Re: Reviving schroot as used by sbuild Stefano Rivera <stefanor@debian.org> - 2024-06-26 18:40 +0200
      Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-26 19:20 +0200
        Re: Reviving schroot as used by sbuild Reinhard Tartler <siretart@gmail.com> - 2024-06-27 00:10 +0200
        Re: Reviving schroot as used by sbuild Helmut Grohne <helmut@subdivi.de> - 2024-06-27 13:50 +0200
          Re: Reviving schroot as used by sbuild Reinhard Tartler <siretart@gmail.com> - 2024-06-27 14:10 +0200
          Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-27 16:00 +0200
            Re: Reviving schroot as used by sbuild Johannes Schauer Marin Rodrigues <josch@debian.org> - 2024-06-27 17:30 +0200
              Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-27 19:20 +0200
                Re: Reviving schroot as used by sbuild Johannes Schauer Marin Rodrigues <josch@debian.org> - 2024-06-27 23:10 +0200
    reproducible Debian containers exists today (Re: Reviving schroot as  used by sbuild) Holger Levsen <holger@layer-acht.org> - 2024-06-26 11:20 +0200
    Re: Reviving schroot as used by sbuild Bastian Venthur <venthur@debian.org> - 2024-06-27 11:00 +0200
      Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-27 19:40 +0200
        Builds that pass locally but fail on sbuild? (Re: Reviving schroot as  used by sbuild) Otto Kekäläinen <otto@debian.org> - 2024-06-28 05:00 +0200
          Re: Builds that pass locally but fail on sbuild? (Re: Reviving  schroot as used by sbuild) Simon McVittie <smcv@debian.org> - 2024-06-28 12:00 +0200
          Re: Builds that pass locally but fail on sbuild? (Re: Reviving schroot as used by sbuild) Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-06-29 18:20 +0200
            Re: Builds that pass locally but fail on sbuild? (Re: Reviving  schroot as used by sbuild) Sam Hartman <hartmans@debian.org> - 2024-06-30 00:00 +0200
    Re: Reviving schroot as used by sbuild Philipp Kern <pkern@debian.org> - 2024-07-01 09:20 +0200
      Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-07-01 18:00 +0200
        Re: Reviving schroot as used by sbuild Reinhard Tartler <siretart@gmail.com> - 2024-07-01 21:20 +0200
      Re: Reviving schroot as used by sbuild Helmut Grohne <helmut@subdivi.de> - 2024-07-06 18:40 +0200
  Re: Reviving schroot as used by sbuild Leandro Cunha <leandrocunha016@gmail.com> - 2024-06-25 20:00 +0200
  Re: Reviving schroot as used by sbuild Sam Hartman <hartmans@debian.org> - 2024-06-28 15:10 +0200
    Re: Reviving schroot as used by sbuild Helmut Grohne <helmut@subdivi.de> - 2024-09-14 12:00 +0200
      Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-09-14 12:40 +0200

csiph-web