Re: [PATCH v6 00/17] add support to build isar unprivileged

[Zhihang Wei <wzh@ilbers.de>]

On 6/25/26 10:59, MOESSBAUER, Felix wrote:
> On Mon, 2026-06-15 at 11:24 +0200, Felix Moessbauer wrote:
>> Dear isar-users,
>>
>> currently isar requires password-less sudo and an environment
>> where mounting file systems is possible. This has proven problematic
>> for security reasons, both when running in a privileged container or
>> locally.
>>
>> To solve this, we implement fully rootless builds that rely on the
>> unshare syscall which allows us to avoid sudo and instead operate in
>> temporary kernel namespaces as a user that is just privileged within
>> that namespace. This comes with some challenges regarding the handling
>> of mounts (they are cleared when leaving the namespace), as well as
>> cross namespace deployments (the outer user might not be able to access
>> the inner data). For that, we rework the handling of mounts and artifact
>> passing to make it compatible with both chroot modes (schroot and
>> unshare).
> Hi,
>
> are there any news on this? As this series has been successfully tested
> in privileged mode, I would like to get it merged, so subsequent
> patches already can use the run_privileged helpers.
>
> Cleanups and improvements still can be done later on, but my fear is
> that we will get a lot of back-and-forth between sudo and
> run_privileged if not merged.
>
> I also have some patches regarding the rootfs_postprocess idempotency
> issues in my pipeline which also depend on the run_privileged wrappers.
>

Hi,

We are currently integrating rootless build testing into our CI pipeline. We
need to ensure that future patches do not break rootless build.

Zhihang

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/c9e52292-273d-4d3f-8791-375a346675c9%40ilbers.de.