Re: [PATCH v4 0/4] non-privileged commands in chroot

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Thu, 2025-09-25 at 08:54 +0200, 'Cedric Hombourger' via isar-users
wrote:
> When building root filesystems for foreign architectures with package source
> caching enabled, apt operations are executed within the rootfs through QEMU
> emulation. This results in significantly degraded performance, particularly
> when downloading source packages sequentially.
> 
> This patch series introduces a new wrapper function that enables native
> command execution against a rootfs while preserving special mount points
> (such as /isar-apt). The approach:
> 
> - Improves build performance for foreign architecture builds
> - Maintains filesystem isolation using bubblewrap
> - Preserves access to special mount points required by isar
> 
> Additional notes:
> - rootfs_cmd may be used to run commands from the host root file-system:
>   use with extreme care to avoid host contamination problems.
> - mmdebstrap already calls apt-get of the host to download packages (in
>   other words, a build of a bookworm image from a trixie host will
>   result in mmdebstrap (from trixie), call apt-get (from trixie) to
>   download bookworm packages. This is the behavior we have before and
>   after these changes.
> - With these changes and when caching of Debian source packages is
>   enabled/requested, Isar will use apt-get of the host to download
>   source packages (it will however do this from a bubblewrap'ed
>   environment to avoid a non-required privilege elevation; Isar has
>   many but we need to start from somewhere).
> 
> Testing:
> - Tested against 9e62337953fbb8371c846c44e8a99d62a8d220ba
> - Basic smoke tests performed successfully (citest.py -t fast)
> - Performance improvements observed in source package acquisition
> - Tested with various foreign architecture configurations

Thanks for bringing this up again. I successfully tested this series on
(amd64, arm64) x (bookworm, trixie).

Tested-by: Felix Moessbauer <felix.moessbauer@siemens.com>

Felix

-- 
Siemens AG
Linux Expert Center
Friedrich-Ludwig-Bauer-Str. 3
85748 Garching, Germany

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/7726069416bb27b02244de47750ffeceb64bd6ca.camel%40siemens.com.