Re: [PATCH 0/9] first wic integration

[Baurzhan Ismagulov <ibr@radix50.net>]

On Wed, Jan 31, 2018 at 03:01:48PM +0100, Jan Kiszka wrote:
> >> BTW, we also need to address unprivileged or container-compatible
> >> binfmt, or we won't be able to do cross stuff. Probably solvable, maybe
> >> via namespace support for binfmt in the upstream kernel, but far from
> >> reachable in the near future.
> > 
> > That is another issue to fix, but it isn't related to hacking wic, is it?
> 
> It is related to the question if we need to worry about sudo wic right
> now or can do this when all the other issues that prevent unprivileged
> Isar building are solved. I would say the latter applies here.

Unprivileged != container-compatible.

Sudo is a hack. Solving it has value.

That said, my concern isn't prioritizing that. My concern is imposing sudo on
wic users when we already have an effective, manageable workaround in master.

There is also an architectural issue with that. All-in sudo would hide the
details why we need it, thus moving unprivileged builds farther away.

At the end, wic should be compatible with Isar and be available without
importing it into Isar. If we want to work with upstream, we should start with
that and not with breaking the existing code. If existing tools were
sufficient, we wouldn't need Isar in the first place; upstreaming should be a
good practical trade-off and not transform into purification that stands in the
way.

Thus my suggestion to keep selective sudo in wic. It doesn't require reworking
the series, we can just drop the patch 7.

With kind regards,
Baurzhan.