Re: [PATCH v2 00/16] add support to build isar unprivileged

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Fri, 2026-02-27 at 15:57 +0100, Felix Moessbauer wrote:
> Dear isar-users,
> 
> currently isar requires password-less sudo and an environment
> where mounting file systems is possible. This has proven problematic
> for security reasons, both when running in a privileged container or
> locally.
> 
> To solve this, we implement fully rootless builds that rely on the
> unshare syscall which allows us to avoid sudo and instead operate in
> temporary kernel namespaces as a user that is just privileged within
> that namespace. This comes with some challenges regarding the handling
> of mounts (they are cleared when leaving the namespace), as well as
> cross namespace deployments (the outer user might not be able to access
> the inner data). For that, we rework the handling of mounts and artifact
> passing to make it compatible with both chroot modes (schroot and
> unshare).
> 
> Note, that this series can be tested on a custom kas-container build
> provided in [1]. Hints how to migrate downstream layers are provided
> in the API changelog.
> 

Dear isar-users,

I'm currently waiting for the isar release and then plan to send out a
v3 that adds support for the cached-base-repo and src / dbg package
downloading. By that, the series should be feature complete.

The last remaining aspect I don't have a solution to (yet) is the
sbuild_dpkg_log_export in dpkg.bbclass. To me it looks like the dpkg
dump is generated but never consumed anywhere. If someone could guide
me how this is processed, I'll implement support for this as well.

We further need to clarify the interface between kas and isar. The
current proposal is as following:

In isar, the rootless mode is activated by setting ISAR_ROOTLESS = "1".
In kas, the rootless mode is selected by setting build_system: isar-
rootless, which then sets the ISAR_ROOTLESS bitbake variable. We need
this two-staged approach, as kas-container needs to be able to parse
the top-level kas file and extract the isar / isar-privileged / isar-
rootless mode so that it can start the container accordingly.

Best regards,
Felix

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/6f5e70f4bffa0b21b3956f64d3699856bd2734a0.camel%40siemens.com.