Re: [PATCH v6 00/17] add support to build isar unprivileged

["'MOESSBAUER, Felix' via isar-users" <isar-users@googlegroups.com>]

On Thu, 2026-06-25 at 14:58 +0200, Zhihang Wei wrote:
> On 6/25/26 10:59, MOESSBAUER, Felix wrote:
> > On Mon, 2026-06-15 at 11:24 +0200, Felix Moessbauer wrote:
> > > Dear isar-users,
> > > 
> > > currently isar requires password-less sudo and an environment
> > > where mounting file systems is possible. This has proven problematic
> > > for security reasons, both when running in a privileged container or
> > > locally.
> > > 
> > > To solve this, we implement fully rootless builds that rely on the
> > > unshare syscall which allows us to avoid sudo and instead operate in
> > > temporary kernel namespaces as a user that is just privileged within
> > > that namespace. This comes with some challenges regarding the handling
> > > of mounts (they are cleared when leaving the namespace), as well as
> > > cross namespace deployments (the outer user might not be able to access
> > > the inner data). For that, we rework the handling of mounts and artifact
> > > passing to make it compatible with both chroot modes (schroot and
> > > unshare).
> > Hi,
> > 
> > are there any news on this? As this series has been successfully tested
> > in privileged mode, I would like to get it merged, so subsequent
> > patches already can use the run_privileged helpers.
> > 
> > Cleanups and improvements still can be done later on, but my fear is
> > that we will get a lot of back-and-forth between sudo and
> > run_privileged if not merged.
> > 
> > I also have some patches regarding the rootfs_postprocess idempotency
> > issues in my pipeline which also depend on the run_privileged wrappers.
> > 
> 
> Hi,
> 
> We are currently integrating rootless build testing into our CI pipeline. We
> need to ensure that future patches do not break rootless build.

Hi, sounds good!

I have an improvement for p10 which avoids the emulation of apt in
rootfs_install_pkgs_download, which I would fold in in case a v7 of
this series is needed (or if you want something to test your
infrastructure).

Otherwise this can also be added later on as a standalone patch. Just
let me know.

Best regards,
Felix

> 
> Zhihang

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/b1e51aaaaea11d2c48133571fcf41a7e8942ef7c.camel%40siemens.com.