From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 25 Jun 2026 14:58:31 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-wm1-f64.google.com (mail-wm1-f64.google.com [209.85.128.64]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 65PCwUTJ003302 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 25 Jun 2026 14:58:30 +0200 Received: by mail-wm1-f64.google.com with SMTP id 5b1f17b1804b1-490a767b782sf20506025e9.2 for ; Thu, 25 Jun 2026 05:58:30 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1782392305; cv=pass; d=google.com; s=arc-20260327; b=E23jpeFf2D8fVxldTVVDnGpgNwiuHHYyQsbldRSftgLXEudoOq+MJiqLXvkaaw9Cfd qi2YYpiQepLTQ4aXndJnGxB7aMALiqHmhBSCjrzsetKgHUVWaRhTkiPoZ+hsujoKJX1Z 9JI7FPdYbym7GoxeREL9OQjmzhMbTw82cbD+Na+cYCMGMb6/8isVTectYblBuXxyqDN4 kyo3JUqyDcANNoqrAhqH3rmLL0qbP/RCzV7637cHEQDGG7WwMF6ppB4olKUnxriE8IT2 oqnnSAigzMpKr662osyNIbdmXJ6iEnEEzTUjHA9TQ3oedAltBHhR8DQN0y/WWSlGb3vt 0IiQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:in-reply-to:content-language :references:cc:to:subject:from:user-agent:mime-version:date :message-id:sender:dkim-signature; bh=O8CRBBybZx15zLvXqwPg7aeOMohgtqt0M9qUa+WibnQ=; fh=6H0O2ris8rb7G1weuT5g4VKCDTsIVbymOLend87n6uQ=; b=GwCDHZ/z5tzqVlV0o8D7c3ReRegLpdoJQjkqCkUAjH7cBbVUV2OatDDmiWQTl2vJE8 BNb5rLbByHzxQhvB1L9AeQoqTweLazBS1qvlNfYFhTTWEJvEbsI/IQ3lcgRt4WdOheU1 inHTkNzky9yFDliXiY0+CWt3YdUJYiJtLWihX6jc8afQn5j/KR02Umb9jkziOK68Nu80 /ZgaqR2jmeKaPPEXa+vA2EPjicU9adWKofWjgvPinEKMhUgZQyUDR9qajxngA0eaQKrp AbFWO+NoHhRw/5P71SObPYToct9Hh10cOOjjfUI5VoV2WkeaWI3w+90ucHN/1zhygV0q AYPw==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1782392305; x=1782997105; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:in-reply-to:content-language:references:cc:to :subject:from:user-agent:mime-version:date:message-id:sender:from:to :cc:subject:date:message-id:reply-to; bh=O8CRBBybZx15zLvXqwPg7aeOMohgtqt0M9qUa+WibnQ=; b=Ra2QddN/AW6ROvq+rEakvTTJSUxBpqFc5sZb5+KnnvX9Uwk+M5EtU8c3BezH6gb137 9cABBDRFUvBDxo8Vk7KPRSP1cH+MbDoU1YxtocVeHrh9lE9Op914EQHHYA0w9Ixv0Iv1 j1bZLzDL/15vH2nfmev8LsF0AZVFTSEcLado41HREga/V8ZIPjAQrEx1lbtOqEKbfw1H ju9LsEU5UR9E/brjxt6FQnFU2p5NOi2VKa0PTV5ABRfXqadEyT9UIeDmBGjIT2aip6pL YwgYJZT7lbqBRU1au7cds7O7e1zlz7tsv8omErCFlU5HjB4TRQoP3zsFdnjM9l0teG6o 2LMg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782392305; x=1782997105; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:in-reply-to :content-language:references:cc:to:subject:from:user-agent :mime-version:date:message-id:x-beenthere:x-gm-message-state:sender :from:to:cc:subject:date:message-id:reply-to; bh=O8CRBBybZx15zLvXqwPg7aeOMohgtqt0M9qUa+WibnQ=; b=mDO7M3BVhLiStQK2Z18wQehPharvzGeACfgvdbXNetLtxuRILPl5wOWhpua+IlgO5k h+5lpStvZ3Z+y2vALTA4lz/MR9px4fdpcPMMp8bSqPDecldjIo9nTkW6s82tsZlx7FXD o8CyfoE/5WUJXagxZs83ZQ0leW5f+mBSrhJI06avOHBCzzQ1PGvG+5YZRy6Pdld/sOIB Q+WlSU405ok0pNNM42XHxQdh5A62NQILFreLL/zFsNNbSxIaks71IvBIYi3nxc9QMupd L2zHaHLAN6HfrW9hyx5ivJLpGadE0kL77JHnVNEW710IRcjpRd0DoeJxo4PuIdA52bSX eBjg== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AFNElJ/Ba1bf1PLQbgXVohj93q+tY51tofGI917WPjmpTTu/vCYHG5P0YyFaOaM8Lt0zwEefw6xg@ilbers.de X-Gm-Message-State: AOJu0YysRZSlHMWWimnHPYDSiGJMsx2/Hstx4EWa3uP+mfZbZpJsh+ID rpzsevu+TD0GDtZhh+dwn1Z5Q0arQN5ACUnSTeY4t02k/iAXpKGy2sgO X-Received: by 2002:a05:600c:4703:b0:492:1e36:1fe9 with SMTP id 5b1f17b1804b1-4926689296fmr29845385e9.37.1782392305008; Thu, 25 Jun 2026 05:58:25 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="AX0PUUdgorPqV0gzi6qUP90tai11aVmnO3ERcY1NqtcMob0MzA==" Received: by 2002:a05:600c:1385:b0:490:4693:b6c9 with SMTP id 5b1f17b1804b1-49237da611fls70121415e9.0.-pod-prod-08-eu; Thu, 25 Jun 2026 05:58:23 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ/revlfX7PYj4gHjs2bP0I3+ckA4+f5AwPjXt/7zUYqiRTpErSjuCCLitI263WZdgYWsMFpyQKUjj7X@googlegroups.com X-Received: by 2002:a05:600c:6215:b0:490:e180:2ed with SMTP id 5b1f17b1804b1-4926683879fmr30613305e9.4.1782392302882; Thu, 25 Jun 2026 05:58:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1782392302; cv=none; d=google.com; s=arc-20260327; b=rkJzNGQJv0rJDqzJ6mRNfYm02nANjwwgM29aoCu/e769xbSI8nWT3pU71aGpCEUZGb 8XIYLF9C524euoAGdDcV+DqersCNAhhRsRuTgrRNLR8e8O5RVND0BA9b10hPSuKAhpGU GXOnporbgOHzwDVCyCRf0LxfBZVsGMtdY4xo62ElMskKoLl1aQ9MEyVCxTatGHzon1r3 pNR+JtDP/02wzIT/A5eJlT0zmwIVxsb9X3mPbEbE4Ybj5bBRzCe3yl3L2AH4FySa4AQi UG5vquwlo1N6v47FjWQMBwOHIWH7/vKLIleOMtVpW5sG/fTq8mAXdaIckMEMCeoXEZ0I +aeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:in-reply-to:content-language:references :cc:to:subject:from:user-agent:mime-version:date:message-id; bh=Fcj9cRGHA1nNY3z98+6EPWQNgbbR4n0pc3DWY2nCns8=; fh=snPUeFaciPd44DGD7CKIfMxKy9UIWquFtZirq2e+a3E=; b=oKAsbjHrOiRlVfeeNlzBzvyXGUszXG0m/XUqDtx+WYtIPVMltzlIH5yhpXW7BYGn2y qA4soWgCCmR4A9Rfv3HpfDGq6PfB0YCDOyqJHYKSwBJtvCZna3OBHqbHS/t4aIGRIkBE GPt1TSo19IS5YOvxCh6JgyoU/URWbD4dw9scTyn3nmWmhR1PoI1ibUCgNBHwK39VQD8h cc+NKJQhj6yfO08naTNFDYBxnOOiGgMNnPRimdvOfvUFIncEoM71SzkEOOatS+W/0T4z NKZ7V0v2khNjUM4YyxIecqsfStHnXpwOXOX81AftYCEaaN08jo5d/7ydhYJ913fBWrN1 hRLQ==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id 5b1f17b1804b1-4926606cb9csi282815e9.2.2026.06.25.05.58.22 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Thu, 25 Jun 2026 05:58:22 -0700 (PDT) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from [192.168.178.148] ([88.130.203.42]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 65PCwLrj003289 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 25 Jun 2026 14:58:22 +0200 Message-ID: Date: Thu, 25 Jun 2026 14:58:21 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird From: Zhihang Wei Subject: Re: [PATCH v6 00/17] add support to build isar unprivileged To: "MOESSBAUER, Felix" , "isar-users@googlegroups.com" Cc: "Kiszka, Jan" , "Gylstorff, Quirin" References: <20260615092458.259691-1-felix.moessbauer@siemens.com> <8b64ce39d3096fd3399056ae2aabf36d763ba88c.camel@siemens.com> Content-Language: en-US In-Reply-To: <8b64ce39d3096fd3399056ae2aabf36d763ba88c.camel@siemens.com> Content-Type: text/plain; charset="UTF-8"; format=flowed X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: sjGNgiirpJ+H On 6/25/26 10:59, MOESSBAUER, Felix wrote: > On Mon, 2026-06-15 at 11:24 +0200, Felix Moessbauer wrote: >> Dear isar-users, >> >> currently isar requires password-less sudo and an environment >> where mounting file systems is possible. This has proven problematic >> for security reasons, both when running in a privileged container or >> locally. >> >> To solve this, we implement fully rootless builds that rely on the >> unshare syscall which allows us to avoid sudo and instead operate in >> temporary kernel namespaces as a user that is just privileged within >> that namespace. This comes with some challenges regarding the handling >> of mounts (they are cleared when leaving the namespace), as well as >> cross namespace deployments (the outer user might not be able to access >> the inner data). For that, we rework the handling of mounts and artifact >> passing to make it compatible with both chroot modes (schroot and >> unshare). > Hi, > > are there any news on this? As this series has been successfully tested > in privileged mode, I would like to get it merged, so subsequent > patches already can use the run_privileged helpers. > > Cleanups and improvements still can be done later on, but my fear is > that we will get a lot of back-and-forth between sudo and > run_privileged if not merged. > > I also have some patches regarding the rootfs_postprocess idempotency > issues in my pipeline which also depend on the run_privileged wrappers. > Hi, We are currently integrating rootless build testing into our CI pipeline. We need to ensure that future patches do not break rootless build. Zhihang -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/c9e52292-273d-4d3f-8791-375a346675c9%40ilbers.de.