vm-less and daemon-less ELBE build via container by koalo · Pull Request #482 · Linutronix/elbe

koalo · 2026-08-25T07:01:30Z

Provides an alternative to building in a VM via (podman) containers.

It supersedes #471 with the following improvements:

No daemon is running inside the container and no SOAP is used. The elbe build command is now really a one-shot build command.
Besides the unprivileged rootless mode that is still preferred for builds where it is possible, a rootful mode is introduced (see eeb56e1 ). That allows to build ELBE images that still rely on these high privileges, e.g. for losetup or grub.
Together with Various fixes for existing warnings #480, the already merged RFC: Support building ELBE images without initvm #471 and fix linking order gpiotest#1, this versions passes all tests from the former test_xml.py for both initvm and container (except pbuilder, which is currently out of scope for the container-based build). The only test case that currently supports rootless mode is the tests/base-extended/simple-validation/image-base.xml. For all others, pytest needs to run with respective privileges (e.g. sudo pytest --runslow -s -v elbepack/tests/test_xml_container.py -k "simple-validation-image.xml" )
The last two commits introduce an insert_partition and a file-command to the XML specification to allow for a broader range of supported scenarios for rootless containers. They do not need to be merged together with the other commits, but would be very helpful going on.

Note: 22e7de7 is duplicated from #480 to avoid a merge conflict. Will rebase after #480 is merged.

t-8ch · 2026-08-25T08:22:05Z

         '(default is a timestamped directory in the current working directory)')
+@add_argument(
+    '--exclude-initvm-pkgs', action='store_true', dest='exclude_initvm_pkgs',
+    default=True,


The commit message says this is "default off"

Well, it is default off for the vm case. That is what I meant.
69a1bc2#diff-b48789c91178aa29b6d2a311083d10f1b7484afac62ce1c94dc709a82e7b114dR321

But thinking about it, it does not make sense to have this CLI option for the container build command at all. Setting it to false for container build will actually just break the build...

Agreed. Let's remove the argument.

Now set unconditionally to True for the build command:

29a9dc5#diff-e3fec1c8f986aaf95a8e35a65605737625ad5fdd28b907bb8b76a109e15d1f53R22

t-8ch · 2026-08-25T08:25:22Z


-        do(['reprepro', *global_opt, 'includedeb', codename, path])
+        do(['reprepro', *global_opt, 'includedeb', codename, path],
+           env_add={'GNUPGHOME': self.gnupg_home})


Unrelated change? We really should just have a wrapper function around reprepro first.

Extracted everything gnupg-related into a separate commit and moved this into a small wrapper
f83a027#diff-4b57cf92e9470b9469f494097ab2e3744bdbc103c65f3a3039fba50916350a94R107

t-8ch · 2026-08-25T08:26:52Z

Would anybody really stick to the vmfull container?

Honestly, I tried, but am unable to understand what the contrib/containerfile/Containerfile is actually used for. So I did not want to break anyones obscure use case. But if that is fine for you, I am happy to drop that and replace it with my Containerfile.

Can we avoid the whole container thing for now and just do the root-less builds from an ELBE source checkout?

In principle, yes. But that requires the system to be set up exactly as ELBE requires it. Not sure if that is really feasible.

It now replaces the previous containerfile
428953e

t-8ch · 2026-08-25T08:35:07Z


+    # use /var/tmp to avoid filling up the RAM with large build artifacts
+    os.environ.setdefault('TMPDIR', '/var/tmp')
+


This is quite specific to Debian, let me think about something more generic.

t-8ch · 2026-08-25T08:35:50Z


+CHECK_BUILD_VARIANTS = ('schema', 'cdrom', 'img', 'sdk')

-@pytest.fixture(scope='module')


Please do the code move changes in a dedicated commit.

Now in a separate commit
4ba8992

t-8ch · 2026-08-25T08:37:09Z



+@_register_action('insert_partition')
+class InsertPartitionAction(ImageFinetuningAction):


Tests please, and newsfragment/

Added tests here
6efd4f8#diff-4ddf2f3cbafa7980c3792e8501151f97e218e1611b9ddfa8273fb08a3a9ccdb7R169-R249

And newsfragment here
e8cb2a4

Please do the newsfragments and docs as part of the commits adding the new stuff.

t-8ch · 2026-08-25T08:43:33Z

+        <annotation>
+          <documentation>
+            execute the defined command in /bin/sh. The command is being executed directly
+            after the filesystem was created, before it is mounted. The placeholder {path}


For consistency the placeholder should be "{file}". But the existing naming is also iffy.

Now file
808d3ca#diff-2e2b84c3878e694397a51c967d43a4521ce0c4a944c1dd0503216cb867880c4fR1804

t-8ch · 2026-09-01T08:58:14Z

I am still daunted by the larger changes in this PR.
Could you move the non-contentious stuff to the beginning, so that I can already pick it up?

It makes my life much easier if I can gradually chip away at big PRs until they become easy.

The preprocessing of the XML file relies on putting the new XML file exactly where the input XML is. This pollutes the input directory and requires the container to have write access to the input directory. Instead, allow to put the output XML at an arbitrary place by providing the xml base to find the original references (like archive dirs). Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

The /var/cache/elbe path was scattered hardcoded at various places throughout ELBE. Refactor to define at a central place to avoid inconsistencies when changing in the future. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

koalo · 2026-09-01T11:10:03Z

@t-8ch Reordered and squashed the commits accordingly.

t-8ch · 2026-09-01T12:07:08Z

+    try:
+        yield
+    finally:
+        os.environ['PATH'] = path


Can we handle this at the source like 6ff06f1

Yes, thanks! 9118496#diff-9e4a35e6b7eb80ff720bd2311e120300d394060efa5dfa514fb30b28049c3276R464

Add an inverse to export partition to inject partition files created in earlier steps (e.g. dm-verity data) into the respective partition. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Add a file-command option that operates on the just created partition image file instead of a loop device. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

elbepack/initvm(action).py currently includes implementations that can be shared with a future VM-less and SOAP-less build command. Extract these into a separate module. This commit only moves code around. No functional change. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Since the buildsubmitaction.py shall be used also without initvm, drop all VM-specific wording from the messages. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Add a new top-level "elbe build" command as alternative to "elbe initvm submit". It drives the project manager directly in-process, without any daemon or SOAP communication. It is meant to be used inside a container that already provides the required isolation. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Adding initvm packages to the CDROMs is not reasonable when there is no initvm. Therefore, exclude them. Also, provide this option as CLI parameter (default off) for initvm builds for consistency. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

The gnupg home directory used for signing and verifying repositories was hardcoded to /var/cache/elbe/gnupg throughout the signing helpers and repository classes. Pass it explicitly instead, so callers can point them at a project-specific keyring. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

With the recent additions, it is no longer necessary to spawn an initvm to build ELBE images. Therefore, provide a container that enables this use case and replace the existing legacy containerfile with it. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

The rbind-based pseudo filesystem mounting for chroot() needs the _Mount helper, but imgutils.py cannot be imported from shellhelper.py without creating a cyclic dependency. Move _Mount there first. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

…cratch Several operations require a chroot with the pseudo filesystems (/proc, /sys and /dev) in it. Inside a container, the container runtime already protects parts of it (like /proc/kcore) by overlaying it with a null bind mount. Doing a fresh mount from scratch (e.g. mount -t proc None foo) inside a completely new mount and user namespace, would expose the content again, so the kernel has explicit procection against it (-> mount_too_revealing). But we do not need fresh pseudo filesystems. We can just rebind what we already have. The only issue with that is that we need to scope it more tightly around the operations that actually require this setup with chroot and pseudo filesystems, otherwise we would fill up the newly created filesystem with stuff from the pseudo filesystems we do not need. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Inside a container, we do not have udev running. Therefore, there is no need to wait for potential interference with udev. Instead, create the device nodes directly from the information in sysfs. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

…without udev Setup UUID as needed e.g. for grub, because that is usually also done by udev. So without udev, we need a replacement for that functionality. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

By unsharing into a new user and mount namespace, we get sufficient permissions to perform (bind) mounts needed for the build process. With this, we can avoid the need for an explicit --cap-add CAP_SYS_ADMIN Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Several actions still require losetup or other actions that require a rootful container (such as mknod). Instead of starting the build and then later failing with an error message, check beforehand for critical elements in the XML and print a respective error message. With proper setup and high privileges it is actually possible to use loop devices or mknod in containers. Provide the respective documentation how. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

/tmp is usually RAM-backed, so when putting build artifacts there, it will fill up very quickly and exhaust the RAM. Therefore, use /var/tmp per default. On Debian systems /var/tmp will still follow a retention policy, so any potential leftovers will be removed after 30 days (in the default configuration). Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Split the test_xml to only contain code that is not directly related to the initvm. This will enable us in the next step to add further tests that will use the container-based approach. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Provide a test driver to run the same tests as for the initvm in test_xml.py for the container-based build as well. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

koalo mentioned this pull request Aug 25, 2026

RFC: Support building ELBE images without initvm #471

Closed

t-8ch reviewed Aug 25, 2026

View reviewed changes

koalo force-pushed the devel/koalo/container-nosoap-stripped branch 5 times, most recently from 06a81d0 to 9e2bcbc Compare September 1, 2026 07:07

koalo force-pushed the devel/koalo/container-nosoap-stripped branch from 9e2bcbc to 94aaee5 Compare September 1, 2026 10:56

koalo added 2 commits September 1, 2026 12:57

koalo force-pushed the devel/koalo/container-nosoap-stripped branch from 94aaee5 to 4a56999 Compare September 1, 2026 11:09

t-8ch reviewed Sep 1, 2026

View reviewed changes

koalo added 16 commits September 1, 2026 14:46

elbepack: finetuning: add insert partition option

9118496

Add an inverse to export partition to inject partition files created in earlier steps (e.g. dm-verity data) into the respective partition. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

elbepack: add a file-command to fs-finetuning

7e97e8c

Add a file-command option that operates on the just created partition image file instead of a loop device. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

elbepack: drop initvm-specific wording from shared messages

0672010

Since the buildsubmitaction.py shall be used also without initvm, drop all VM-specific wording from the messages. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

elbepack: tests: provide test for build without initvm

f1a8feb

Provide a test driver to run the same tests as for the initvm in test_xml.py for the container-based build as well. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

koalo force-pushed the devel/koalo/container-nosoap-stripped branch from 4a56999 to f1a8feb Compare September 1, 2026 12:50


		# use /var/tmp to avoid filling up the RAM with large build artifacts
		os.environ.setdefault('TMPDIR', '/var/tmp')


		CHECK_BUILD_VARIANTS = ('schema', 'cdrom', 'img', 'sdk')

		@pytest.fixture(scope='module')



		@_register_action('insert_partition')
		class InsertPartitionAction(ImageFinetuningAction):

Uh oh!

Conversation

koalo commented Aug 25, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

t-8ch commented Sep 1, 2026

Uh oh!

koalo commented Sep 1, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants