[PATCH v3 00/16] add support to build isar unprivileged

'Felix Moessbauer' via isar-users
2026-04-07T14:23:31Z

Dear isar-users,

currently isar requires password-less sudo and an environment
where mounting file systems is possible. This has proven problematic
for security reasons, both when running in a privileged container or
locally.

To solve this, we implement fully rootless builds that rely on the
unshare syscall which allows us to avoid sudo and instead operate in
temporary kernel namespaces as a user that is just privileged within
that namespace. This comes with some challenges regarding the handling
of mounts (they are cleared when leaving the namespace), as well as
cross namespace deployments (the outer user might not be able to access
the inner data). For that, we rework the handling of mounts and artifact
passing to make it compatible with both chroot modes (schroot and
unshare).

Note, that this series can be tested on a custom kas-container build
provided in [1]. Hints how to migrate downstream layers are provided
in the API changelog.

Changes since PATCH v2:

- add support for cached base apt
- rootfs sstate: do not rely on fd3 for copy out, as not always available
- sbom: use local copy of sbom rootfs to not leave shared instance behind
- testsuite: add parameter to run in rootless mode
- rebased onto v1.0

Changes since PATCH v1:

- fixed broken rebase onto next
- fix root_cleandirs implementation

NOTE: This requires the kas series (v3) from [1] for rootless building.

Changes since RFC 2:

- rebased onto next
- fix usage of root_cleandirs
- simplify file permission handling by mapping caller user to
root inside the namespace. By that, in most cases no changes
to the imager are needed anymore.
- implement support for devshell under rootless
- switch to getpass.getuser() to query user (needed for dynamically
created / remapped kas builder user)
- rework mapping to be more similar to mapping used by mmdebstrap
- sbuild: only copy-out of dpkg.log on schroot (unclear if needed
on unshare. To be clarified)
- imager-sbom: ensure sbom is extracted before entering the chroot

Changes since RFC 1:

- switch build_type to isar-rootless in isar.yaml (Note: switch back
if testing locally in a unprepared kas container)
- complete overhaul of the mounting in unshared namespaces
- fixes the systemd presetting
- fixes hangs when pulling from snapshot mirrors
- rename the run_privileged_here to run_privileged_heredoc to clarify its intention
- add support for
- dpkg-source with do_fetch_common_source
- vm images
- container images
- discoverable disk images
- add helper script to clean build dir in unprivileged mode
- reduce clutter we leave after finishing a build
- fix issues when running in a privileged environment without sub user ids
- bugfixes

Note, that the rootless build dir must not reside in a git worktree (a normal git
dir is fine). This is probably a bug in combination with kas-container.

[1] https://groups.google.com/g/kas-devel/c/NWQFCU2aUHg

Best regards,
Felix Moessbauer
Siemens AG

Felix Moessbauer (16):
refactor bootstrap: store rootfs tar with user permissions
deb-dl-dir: export without root privileges
download debs without locking
introduce wrappers for privileged execution
bootstrap: move cleanup trap to function
rootfs: rework sstate caching of rootfs artifact
rootfs_generate_initramfs: rework deployment to avoid chowning
use bitbake function to generate mounting scripts
apt-fetcher: prepare for chroot specific fetching
add support for fully rootless builds
add helper script to clean artifacts in build dir
apt-fetcher: implement support for unshare backend
dpkg-source: implement multiarch support for unshare backend
use copy of sbom-chroot for sbom creation
add support for devshell on unshare backend
testsuite: add parameter to run tests in rootless mode

Kconfig | 2 +-
RECIPE-API-CHANGELOG.md | 42 ++++
doc/user_manual.md | 2 +
kas/isar.yaml | 2 +-
meta/classes-global/base.bbclass | 124 ++++++++++-
meta/classes-recipe/deb-dl-dir.bbclass | 24 ++-
meta/classes-recipe/dpkg-base.bbclass | 94 ++++++--
meta/classes-recipe/dpkg-source.bbclass | 40 +++-
meta/classes-recipe/dpkg.bbclass | 19 +-
.../image-account-extension.bbclass | 4 +-
.../image-locales-extension.bbclass | 13 +-
.../image-postproc-extension.bbclass | 30 +--
.../image-tools-extension.bbclass | 114 +++++++++-
meta/classes-recipe/image.bbclass | 21 +-
.../imagetypes_container.bbclass | 28 +--
meta/classes-recipe/imagetypes_wic.bbclass | 10 +-
meta/classes-recipe/rootfs.bbclass | 203 +++++++++---------
meta/classes-recipe/sbuild.bbclass | 34 ++-
meta/classes-recipe/sdk.bbclass | 22 +-
meta/classes/sbom.bbclass | 28 ++-
meta/conf/bitbake.conf | 7 +-
meta/lib/aptsrc_fetcher.py | 87 +++++++-
.../isar-mmdebstrap/isar-mmdebstrap.inc | 55 +++--
.../sbom-chroot/sbom-chroot.bb | 11 +-
.../sbuild-chroot/sbuild-chroot.inc | 24 ++-
scripts/isar-clean-builddir | 73 +++++++
testsuite/cibuilder.py | 6 +
.../unittests/test_image_account_extension.py | 9 +-
28 files changed, 882 insertions(+), 246 deletions(-)
create mode 100755 scripts/isar-clean-builddir

--
2.53.0

--
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260407142310.2327696-1-felix.moessbauer%40siemens.com.