Re: ISAR schroot mountpoints when running in container

["Bezdeka, Florian" <florian.bezdeka@siemens.com>]

On Fri, 2022-07-01 at 09:36 +0000, Moessbauer, Felix (T CED SES-DE)
wrote:
> > -----Original Message-----
> > From: Bezdeka, Florian (T CED SES-DE) <florian.bezdeka@siemens.com>
> > Sent: Friday, July 1, 2022 11:28 AM
> > To: isar-users@googlegroups.com; kas-devel@googlegroups.com;
> > Moessbauer,
> > Felix (T CED SES-DE) <felix.moessbauer@siemens.com>
> > Cc: Bossert, Andre (DI FA CTR SVC PRC2)
> > <andre.bossert@siemens.com>; Kiszka,
> > Jan (T CED) <jan.kiszka@siemens.com>; Schild, Henning (T CED SES-
> > DE)
> > <henning.schild@siemens.com>
> > Subject: Re: ISAR schroot mountpoints when running in container
> > 
> > On Fri, 2022-07-01 at 09:11 +0000, Moessbauer, Felix wrote:
> > > Hi,
> > > 
> > > as we now have sbuild in ISAR next, first users stumble upon
> > > issues
> > > when running the kas docker image in the gitlab-ci.
> > > This requires additional mountpoints, as the schroot itself uses
> > > overlayfs and stacking two overlayfs is not possible.
> > > By that, you have to mount the overlay from the host.
> > > 
> > > The kas-container script already has support for that, but it
> > > lacks
> > > documentation on how to configure this manually.
> > > In short: The following mountpoint has to be added (as RW):
> > > /var/lib/schroot/union/overlay
> > 
> > So you added this mount point to your gitlab runner configuration?
> > If so, can this
> > mount (safely) be shared between multiple gitlab build jobs
> > (running at the same
> > time)?
> 
> The question boils down to "can this mountpoint safely be shared
> across ISAR runs", and this should be possible.
> We run this code for a while and never experienced any sharing
> issues.
> 
> The schroots also have a PID component in their name. [1]
> But I'm not 100% sure that the PIDs in the privileged container are
> unique across all containers.
> At least for non-privileged containers you have local-only PIDs (or
> better, a local PID namespace).

Privileged containers have their own PID namespace as well - as long as
you do not tell the container runtime to share it - so we might end up
with bitbake processes having the same PID for different builds.

> 
> Felix
> 
> [1]
> https://github.com/ilbers/isar/blob/next/meta/classes/sbuild.bbclass#L26
> 
> > 
> > > 
> > > As this is neither an ISAR issue, nor a KAS issue per-se, I send
> > > this
> > > to both lists.
> > > 
> > > Felix
> > > --
> > > Siemens AG, Linux Expert Center
> > > Otto-Hahn-Ring 6, 81739 München, Germany
> > > 
>