Re: Reviving schroot as used by sbuild

From	Philipp Kern <pkern@debian.org>
Newsgroups	linux.debian.devel
Subject	Re: Reviving schroot as used by sbuild
Date	2024-07-01 09:20 +0200
Message-ID	<IVjup-6SBW-9@gated-at.bofh.it> (permalink)
References	<IT9zb-5qAc-3@gated-at.bofh.it> <ITe5P-5u22-1@gated-at.bofh.it> <IVjup-6SBW-11@gated-at.bofh.it>
Organization	Debian

Show all headers | View raw

Hi,

On 2024-06-29 22:21, Christian Kastner wrote:
>> At the moment, rootless Podman would seem like the obvious choice. As 
>> far
>> as I'm aware, it has the same user namespaces requirements as the 
>> unshare
>> backends in mmdebstrap, autopkgtest and schroot (user namespaces 
>> enabled,
>> setuid newuidmap, 65536 uids in /etc/subuid, 65536 gids in 
>> /etc/subgid).
> 
> As a datapoint, I use rootless podman containers extensively both for
> autopkgtest and as an sbuild backend (though the latter is affected by
> #1033352 for which I still need to implement a cleaner workaround).
> 
> I think the only problem I encountered was a corner case when passing 
> in
> a device into a container: at some point, autopkgtest runs su which 
> uses
> the setgroups() syscall, and group permissions get lost. The solution
> was to setup up the proper gidmaps. I documented my findings here [1].
> 
> Though this latter issue shouldn't be a problem on buildds, where
> devices aren't passed in.

How well does this setup nest? I had a lot of trouble trying to run the 
unshare backend within an unprivileged container as setup by 
systemd-nspawn - mostly with device nodes. In the end I had to give up 
and replaced the container with a full-blown VM. I understand that some 
of the things compose a little if the submaps are set up correctly, with 
less IDs allocated to the nested child. Is there a way to make this work 
properly, or would you always run into setup issues with device nodes at 
this point?

Specifically I'm concerned about what this means for tests and if they 
should be able to use unprivileged containers themselves to test things. 
I guess we made the decision that we just assume "root" for testing. But 
right now you could - presumably - also setup more things under that 
assumption that would not work in an unprivileged setup. Is that a 
problem?

Relatedly it'd be great if we actually had a VM in-between us and the 
build. But that only works well on some architectures, only composes 
well on even less (e.g. arm64 not having nested virtualization yet), and 
only provides a marginal benefit if you execute the build outside of the 
VM as well. But it'd shield us more from supply chain issues.

Kind regards
Philipp Kern

Thread

Reviving schroot as used by sbuild Helmut Grohne <helmut@subdivi.de> - 2024-06-25 10:20 +0200
  Re: Reviving schroot as used by sbuild Johannes Schauer Marin Rodrigues <josch@debian.org> - 2024-06-25 11:40 +0200
  Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-25 15:10 +0200
    Re: Reviving schroot as used by sbuild Andrey Rakhmatullin <wrar@debian.org> - 2024-06-25 15:30 +0200
    Re: Reviving schroot as used by sbuild Faidon Liambotis <paravoid@debian.org> - 2024-06-25 15:30 +0200
    Re: Reviving schroot as used by sbuild Antonio Terceiro <terceiro@debian.org> - 2024-06-25 17:30 +0200
    Re: Reviving schroot as used by sbuild Russ Allbery <rra@debian.org> - 2024-06-25 18:40 +0200
      Re: Reviving schroot as used by sbuild Guillem Jover <guillem@debian.org> - 2024-06-25 18:50 +0200
        Re: Reviving schroot as used by sbuild Marco d'Itri <md@Linux.IT> - 2024-06-25 19:10 +0200
        Re: Reviving schroot as used by sbuild Russ Allbery <rra@debian.org> - 2024-06-25 19:30 +0200
          Re: Reviving schroot as used by sbuild Andrey Rakhmatullin <wrar@debian.org> - 2024-06-25 19:40 +0200
          Re: Reviving schroot as used by sbuild Russ Allbery <rra@debian.org> - 2024-06-25 19:50 +0200
          Re: Reviving schroot as used by sbuild PICCA Frederic-Emmanuel <frederic-emmanuel.picca@synchrotron-soleil.fr> - 2024-06-25 19:50 +0200
        Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-26 18:10 +0200
      Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-25 19:00 +0200
    Re: Reviving schroot as used by sbuild Helmut Grohne <helmut@subdivi.de> - 2024-06-25 19:00 +0200
      autopkgtest + podman user experience (Was: Re: Reviving schroot as  used by sbuild) Gioele Barabucci <gioele@svario.it> - 2024-06-25 20:20 +0200
        Re: autopkgtest + podman user experience (Was: Re: Reviving schroot  as used by sbuild) Paul Gevers <elbrus@debian.org> - 2024-06-25 22:20 +0200
      Re: Reviving schroot as used by sbuild Paul Gevers <elbrus@debian.org> - 2024-06-25 22:00 +0200
      Re: Reviving schroot as used by sbuild Stefano Rivera <stefanor@debian.org> - 2024-06-26 18:40 +0200
      Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-26 19:20 +0200
        Re: Reviving schroot as used by sbuild Reinhard Tartler <siretart@gmail.com> - 2024-06-27 00:10 +0200
        Re: Reviving schroot as used by sbuild Helmut Grohne <helmut@subdivi.de> - 2024-06-27 13:50 +0200
          Re: Reviving schroot as used by sbuild Reinhard Tartler <siretart@gmail.com> - 2024-06-27 14:10 +0200
          Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-27 16:00 +0200
            Re: Reviving schroot as used by sbuild Johannes Schauer Marin Rodrigues <josch@debian.org> - 2024-06-27 17:30 +0200
              Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-27 19:20 +0200
                Re: Reviving schroot as used by sbuild Johannes Schauer Marin Rodrigues <josch@debian.org> - 2024-06-27 23:10 +0200
    reproducible Debian containers exists today (Re: Reviving schroot as  used by sbuild) Holger Levsen <holger@layer-acht.org> - 2024-06-26 11:20 +0200
    Re: Reviving schroot as used by sbuild Bastian Venthur <venthur@debian.org> - 2024-06-27 11:00 +0200
      Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-06-27 19:40 +0200
        Builds that pass locally but fail on sbuild? (Re: Reviving schroot as  used by sbuild) Otto Kekäläinen <otto@debian.org> - 2024-06-28 05:00 +0200
          Re: Builds that pass locally but fail on sbuild? (Re: Reviving  schroot as used by sbuild) Simon McVittie <smcv@debian.org> - 2024-06-28 12:00 +0200
          Re: Builds that pass locally but fail on sbuild? (Re: Reviving schroot as used by sbuild) Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-06-29 18:20 +0200
            Re: Builds that pass locally but fail on sbuild? (Re: Reviving  schroot as used by sbuild) Sam Hartman <hartmans@debian.org> - 2024-06-30 00:00 +0200
    Re: Reviving schroot as used by sbuild Philipp Kern <pkern@debian.org> - 2024-07-01 09:20 +0200
      Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-07-01 18:00 +0200
        Re: Reviving schroot as used by sbuild Reinhard Tartler <siretart@gmail.com> - 2024-07-01 21:20 +0200
      Re: Reviving schroot as used by sbuild Helmut Grohne <helmut@subdivi.de> - 2024-07-06 18:40 +0200
  Re: Reviving schroot as used by sbuild Leandro Cunha <leandrocunha016@gmail.com> - 2024-06-25 20:00 +0200
  Re: Reviving schroot as used by sbuild Sam Hartman <hartmans@debian.org> - 2024-06-28 15:10 +0200
    Re: Reviving schroot as used by sbuild Helmut Grohne <helmut@subdivi.de> - 2024-09-14 12:00 +0200
      Re: Reviving schroot as used by sbuild Simon McVittie <smcv@debian.org> - 2024-09-14 12:40 +0200

csiph-web