Re: [PATCH 0/9] first wic integration

[Henning Schild <henning.schild@siemens.com>]

Am Wed, 31 Jan 2018 16:21:18 +0100
schrieb Baurzhan Ismagulov <ibr@radix50.net>:

> On Wed, Jan 31, 2018 at 03:01:48PM +0100, Jan Kiszka wrote:
> > >> BTW, we also need to address unprivileged or container-compatible
> > >> binfmt, or we won't be able to do cross stuff. Probably
> > >> solvable, maybe via namespace support for binfmt in the upstream
> > >> kernel, but far from reachable in the near future.  
> > > 
> > > That is another issue to fix, but it isn't related to hacking
> > > wic, is it?  
> > 
> > It is related to the question if we need to worry about sudo wic
> > right now or can do this when all the other issues that prevent
> > unprivileged Isar building are solved. I would say the latter
> > applies here.  
> 
> Unprivileged != container-compatible.
> 
> Sudo is a hack. Solving it has value.
> 
> That said, my concern isn't prioritizing that. My concern is imposing
> sudo on wic users when we already have an effective, manageable
> workaround in master.

No we do not. The stuff in master is a ton of "sudo" and
all-you-can-eat sudo for plugins, totally unsafe like the patch i sent.

> There is also an architectural issue with that. All-in sudo would
> hide the details why we need it, thus moving unprivileged builds
> farther away.

I have a patch ready that takes care of "du" and "mkfs" and therefore
documents their "sudo"-needs.

Henning

> At the end, wic should be compatible with Isar and be available
> without importing it into Isar. If we want to work with upstream, we
> should start with that and not with breaking the existing code. If
> existing tools were sufficient, we wouldn't need Isar in the first
> place; upstreaming should be a good practical trade-off and not
> transform into purification that stands in the way.
> 
> Thus my suggestion to keep selective sudo in wic. It doesn't require
> reworking the series, we can just drop the patch 7.
> 
> With kind regards,
> Baurzhan.
>