Re: [PATCH v6 00/17] add support to build isar unprivileged

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Mon, 2026-06-15 at 11:24 +0200, Felix Moessbauer wrote:
> Dear isar-users,
> 
> currently isar requires password-less sudo and an environment
> where mounting file systems is possible. This has proven problematic
> for security reasons, both when running in a privileged container or
> locally.
> 
> To solve this, we implement fully rootless builds that rely on the
> unshare syscall which allows us to avoid sudo and instead operate in
> temporary kernel namespaces as a user that is just privileged within
> that namespace. This comes with some challenges regarding the handling
> of mounts (they are cleared when leaving the namespace), as well as
> cross namespace deployments (the outer user might not be able to access
> the inner data). For that, we rework the handling of mounts and artifact
> passing to make it compatible with both chroot modes (schroot and
> unshare).

Hi,

are there any news on this? As this series has been successfully tested
in privileged mode, I would like to get it merged, so subsequent
patches already can use the run_privileged helpers.

Cleanups and improvements still can be done later on, but my fear is
that we will get a lot of back-and-forth between sudo and
run_privileged if not merged.

I also have some patches regarding the rootfs_postprocess idempotency
issues in my pipeline which also depend on the run_privileged wrappers.

Best regards,
Felix

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/8b64ce39d3096fd3399056ae2aabf36d763ba88c.camel%40siemens.com.