Re: [PATCH v4 00/17] add support to build isar unprivileged

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Thu, 2026-06-04 at 09:41 +0300, Anton Mikanovich wrote:
> 01.06.2026 14:34, 'Felix Moessbauer' via isar-users wrote:
> > Dear isar-users,
> > 
> > currently isar requires password-less sudo and an environment
> > where mounting file systems is possible. This has proven problematic
> > for security reasons, both when running in a privileged container or
> > locally.
> > 
> > To solve this, we implement fully rootless builds that rely on the
> > unshare syscall which allows us to avoid sudo and instead operate in
> > temporary kernel namespaces as a user that is just privileged within
> > that namespace. This comes with some challenges regarding the handling
> > of mounts (they are cleared when leaving the namespace), as well as
> > cross namespace deployments (the outer user might not be able to access
> > the inner data). For that, we rework the handling of mounts and artifact
> > passing to make it compatible with both chroot modes (schroot and
> > unshare).
> > 
> > Note, that this series can be tested on a custom kas-container build
> > provided in [1]. Hints how to migrate downstream layers are provided
> > in the API changelog.
> Hello Felix,
> 
> This patchset version just have passed both fast and full CI.

Thanks for testing this. I propose to merge it soon (ish) to ensure all
future patches already use the run_privileged wrappers. This also
allows downstream layers (like isar-cip-core) to adjust to the wrappers
and offer more broad testing.

The corresponding kas patches also landed in kas:next.

CC Quirin

Felix

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/364e5b31aade11ec20d1a65da29b6d6684662e42.camel%40siemens.com.