I think you should guide new users to do the work in a clean VM and
say that containers don't work. For users that don't have a preferred
way to setup a VM you should pick one and guide them.
<TLDR>
Since you run parts as root and require passwordless sudo, the user should really be doing this work with a safety net even if they are running on a supported host distro.
If your day job is ISAR then perhaps you are running native but this won't be the case for most people trying this out.
I first thought I would try a container.
I tried docker a bit and failed. (I am not an experienced docker user).
I next tried lxd which I have used a decent bit. Even with a privileged container I could not get ISAR to run. It would fail when trying to mount /dev into the buildroot.
I did see discussion of docker debian/jessie-slim etc in one of the github issues. Is someone running ISAR in docker? If so I would like to know how to make this work.
After failing containers I tried a fresh VM. I tried it two ways and both worked.
While travelling last weekend I used Virtualbox on Windows to run the Debian Jessie netinstall CD. When I got back home I used vagrant with libvirt provider on Ubuntu. (Vagrant w/ Virtualbox on Windows and Linux should work also but I did not try these). Of course spinning up a machine in a cloud provider should work as well but I did not try.
</TLDR>
3) Provide extra host configuration guidance
I know how to enable jessie-backports but I am not sure everyone will.
Some methods of getting a clean VM leaves the locales unconfigured which causes a problem with bitbake. I use:
sudo dpkg-reconfigure locales
and then pick en_US.UTF-8 UTF8 from the text menu.
I think there are better ways also.
4) Provide a build dir delete script or task
Since some of the files in the build dir are owned by root, the normal user can't delete them. The user will be tempted to do sudo -rf build but that is very dangerous if there are stray mounts in the tree.
I know you have added more cleanup of the dev and proc mounts but I worry that it may not cover every situation. sudo rm -rf /dev is a rather nasty thing to do.
I know you are looking to add support for psuedo but that may not be enough and may take some time to get there.
I think you should put a ./delete-build-dir scipt into the base of the build dir when you create it.
This script could iterate sudo umount commands, run a user level rm -rf and then check that what is left is truly expected before doing sudo rm -rf on it.
Of course if the user is in a VM the damage is contained and a reboot of the VM should fix things but this would still be good practice IMHO.
-------
Should I create issues for these 4 items?
This is my feedback so far.
I did read over the recipes, classes and main scripts and have a decent understanding of the basics.
Thanks for your attention.
Bill