Re: [PATCH v3 00/16] add support to build isar unprivileged

[Zhihang Wei <wzh@ilbers.de>]

On 5/29/26 15:07, MOESSBAUER, Felix wrote:
> On Fri, 2026-05-29 at 14:28 +0200, Zhihang Wei wrote:
>> On 5/26/26 11:43, 'MOESSBAUER, Felix' via isar-users wrote:
>>> On Tue, 2026-04-07 at 16:22 +0200, Felix Moessbauer wrote:
>>>> Dear isar-users,
>>>>
>>>> currently isar requires password-less sudo and an environment
>>>> where mounting file systems is possible. This has proven problematic
>>>> for security reasons, both when running in a privileged container or
>>>> locally.
>>>>
>>>> To solve this, we implement fully rootless builds that rely on the
>>>> unshare syscall which allows us to avoid sudo and instead operate in
>>>> temporary kernel namespaces as a user that is just privileged within
>>>> that namespace. This comes with some challenges regarding the handling
>>>> of mounts (they are cleared when leaving the namespace), as well as
>>>> cross namespace deployments (the outer user might not be able to access
>>>> the inner data). For that, we rework the handling of mounts and artifact
>>>> passing to make it compatible with both chroot modes (schroot and
>>>> unshare).
>>> Any news on this one? Do you want me to send a rebase? I did not
>>> receive any objections regarding the proposed interface on the kas
>>> side. By that, I would like to move forward with this.
>>>
>>> I'm also fine with scheduling this behind the testsuite execution
>>> series ("Improve testsuite executability, basic GitHub CI"), as this
>>> significantly simplifies testing.
>>>
>>> Just let me know.
>>>
>>> Best regards,
>>> Felix
>> Hi Felix,
>>
>> We were testing this patch on downstreams and in CI. Tests on
>> downstreams seem
>> fine.
> Hi, that's good to know. The corresponding kas patches are now also
> rebased and will be added to kas:next soon [1]
>
> [1] https://groups.google.com/g/kas-devel/c/ibWQT0-FtCg
>

That's good to know.

>> One issue did show up on CI. "InitRdCrossTests.test_dracut_in_image" in full
>> failed. (There are two test cases named as test_dracut_in_image, one in
>> fast,
>> one in full).
>>
>> Specifically, the built image isar-image-ci-debian-bookworm-qemuarm64
>> does not
>> boot. I found nothing was added into the initrd. The generated initrd
>> image has
>> a size of zero bytes.
> I'll have a look. Thanks for the detailed report. Just for
> clarification: Does this fail under rootless or default / root?
It's under default root.

Zhihang

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/5b55371c-825d-4ab2-aaa5-fd55733c34fe%40ilbers.de.