vm-less and daemon-less ELBE build via container by koalo · Pull Request #482 · Linutronix/elbe

koalo · 2026-08-25T07:01:30Z

Provides an alternative to building in a VM via (podman) containers.

It supersedes #471 with the following improvements:

No daemon is running inside the container and no SOAP is used. The elbe build command is now really a one-shot build command.
Besides the unprivileged rootless mode that is still preferred for builds where it is possible, a rootful mode is introduced (see eeb56e1 ). That allows to build ELBE images that still rely on these high privileges, e.g. for losetup or grub.
Together with Various fixes for existing warnings #480, the already merged RFC: Support building ELBE images without initvm #471 and fix linking order gpiotest#1, this versions passes all tests from the former test_xml.py for both initvm and container (except pbuilder, which is currently out of scope for the container-based build). The only test case that currently supports rootless mode is the tests/base-extended/simple-validation/image-base.xml. For all others, pytest needs to run with respective privileges (e.g. sudo pytest --runslow -s -v elbepack/tests/test_xml_container.py -k "simple-validation-image.xml" )
The last two commits introduce an insert_partition and a file-command to the XML specification to allow for a broader range of supported scenarios for rootless containers. They do not need to be merged together with the other commits, but would be very helpful going on.

Note: 22e7de7 is duplicated from #480 to avoid a merge conflict. Will rebase after #480 is merged.

t-8ch · 2026-08-25T08:22:05Z

         '(default is a timestamped directory in the current working directory)')
+@add_argument(
+    '--exclude-initvm-pkgs', action='store_true', dest='exclude_initvm_pkgs',
+    default=True,


The commit message says this is "default off"

Well, it is default off for the vm case. That is what I meant.
69a1bc2#diff-b48789c91178aa29b6d2a311083d10f1b7484afac62ce1c94dc709a82e7b114dR321

But thinking about it, it does not make sense to have this CLI option for the container build command at all. Setting it to false for container build will actually just break the build...

Agreed. Let's remove the argument.

Now set unconditionally to True for the build command:

29a9dc5#diff-e3fec1c8f986aaf95a8e35a65605737625ad5fdd28b907bb8b76a109e15d1f53R22

t-8ch · 2026-08-25T08:25:22Z


-        do(['reprepro', *global_opt, 'includedeb', codename, path])
+        do(['reprepro', *global_opt, 'includedeb', codename, path],
+           env_add={'GNUPGHOME': self.gnupg_home})


Unrelated change? We really should just have a wrapper function around reprepro first.

Extracted everything gnupg-related into a separate commit and moved this into a small wrapper
f83a027#diff-4b57cf92e9470b9469f494097ab2e3744bdbc103c65f3a3039fba50916350a94R107

t-8ch · 2026-08-25T08:26:52Z

Would anybody really stick to the vmfull container?

Honestly, I tried, but am unable to understand what the contrib/containerfile/Containerfile is actually used for. So I did not want to break anyones obscure use case. But if that is fine for you, I am happy to drop that and replace it with my Containerfile.

Can we avoid the whole container thing for now and just do the root-less builds from an ELBE source checkout?

In principle, yes. But that requires the system to be set up exactly as ELBE requires it. Not sure if that is really feasible.

It now replaces the previous containerfile
428953e

t-8ch · 2026-08-25T08:35:07Z


+    # use /var/tmp to avoid filling up the RAM with large build artifacts
+    os.environ.setdefault('TMPDIR', '/var/tmp')
+


This is quite specific to Debian, let me think about something more generic.

t-8ch · 2026-08-25T08:35:50Z


+CHECK_BUILD_VARIANTS = ('schema', 'cdrom', 'img', 'sdk')

-@pytest.fixture(scope='module')


Please do the code move changes in a dedicated commit.

Now in a separate commit
4ba8992

t-8ch · 2026-08-25T08:37:09Z



+@_register_action('insert_partition')
+class InsertPartitionAction(ImageFinetuningAction):


Tests please, and newsfragment/

Added tests here
6efd4f8#diff-4ddf2f3cbafa7980c3792e8501151f97e218e1611b9ddfa8273fb08a3a9ccdb7R169-R249

And newsfragment here
e8cb2a4

Please do the newsfragments and docs as part of the commits adding the new stuff.

t-8ch · 2026-09-01T08:58:14Z

I am still daunted by the larger changes in this PR.
Could you move the non-contentious stuff to the beginning, so that I can already pick it up?

It makes my life much easier if I can gradually chip away at big PRs until they become easy.

koalo · 2026-09-01T11:10:03Z

@t-8ch Reordered and squashed the commits accordingly.

Add a new top-level "elbe build" command as alternative to "elbe initvm submit". It drives the project manager directly in-process, without any daemon or SOAP communication. It is meant to be used inside a container that already provides the required isolation. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Adding initvm packages to the CDROMs is not reasonable when there is no initvm. Therefore, exclude them. Also, provide this option as CLI parameter (default off) for initvm builds for consistency. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

The gnupg home directory used for signing and verifying repositories was hardcoded to /var/cache/elbe/gnupg throughout the signing helpers and repository classes. Pass it explicitly instead, so callers can point them at a project-specific keyring. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

With the recent additions, it is no longer necessary to spawn an initvm to build ELBE images. Therefore, provide a container that enables this use case and replace the existing legacy containerfile with it. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

The rbind-based pseudo filesystem mounting for chroot() needs the _Mount helper, but imgutils.py cannot be imported from shellhelper.py without creating a cyclic dependency. Move _Mount there first. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

…cratch Several operations require a chroot with the pseudo filesystems (/proc, /sys and /dev) in it. Inside a container, the container runtime already protects parts of it (like /proc/kcore) by overlaying it with a null bind mount. Doing a fresh mount from scratch (e.g. mount -t proc None foo) inside a completely new mount and user namespace, would expose the content again, so the kernel has explicit procection against it (-> mount_too_revealing). But we do not need fresh pseudo filesystems. We can just rebind what we already have. The only issue with that is that we need to scope it more tightly around the operations that actually require this setup with chroot and pseudo filesystems, otherwise we would fill up the newly created filesystem with stuff from the pseudo filesystems we do not need. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Inside a container, we do not have udev running. Therefore, there is no need to wait for potential interference with udev. Instead, create the device nodes directly from the information in sysfs. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

…without udev Setup UUID as needed e.g. for grub, because that is usually also done by udev. So without udev, we need a replacement for that functionality. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

By unsharing into a new user and mount namespace, we get sufficient permissions to perform (bind) mounts needed for the build process. With this, we can avoid the need for an explicit --cap-add CAP_SYS_ADMIN Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Several actions still require losetup or other actions that require a rootful container (such as mknod). Instead of starting the build and then later failing with an error message, check beforehand for critical elements in the XML and print a respective error message. With proper setup and high privileges it is actually possible to use loop devices or mknod in containers. Provide the respective documentation how. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

/tmp is usually RAM-backed, so when putting build artifacts there, it will fill up very quickly and exhaust the RAM. Therefore, use /var/tmp per default. On Debian systems /var/tmp will still follow a retention policy, so any potential leftovers will be removed after 30 days (in the default configuration). Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Split the test_xml to only contain code that is not directly related to the initvm. This will enable us in the next step to add further tests that will use the container-based approach. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

Provide a test driver to run the same tests as for the initvm in test_xml.py for the container-based build as well. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

koalo mentioned this pull request Aug 25, 2026

RFC: Support building ELBE images without initvm #471

Closed

t-8ch reviewed Aug 25, 2026

View reviewed changes

koalo force-pushed the devel/koalo/container-nosoap-stripped branch 5 times, most recently from 06a81d0 to 9e2bcbc Compare September 1, 2026 07:07

koalo force-pushed the devel/koalo/container-nosoap-stripped branch 2 times, most recently from 94aaee5 to 4a56999 Compare September 1, 2026 11:09

t-8ch reviewed Sep 1, 2026

View reviewed changes

Comment thread elbepack/tests/test_finetuning.py Outdated

koalo force-pushed the devel/koalo/container-nosoap-stripped branch from 4a56999 to f1a8feb Compare September 1, 2026 12:50

koalo added 13 commits September 4, 2026 12:13

elbepack: tests: provide test for build without initvm

7200369

Provide a test driver to run the same tests as for the initvm in test_xml.py for the container-based build as well. Signed-off-by: Florian Kauer <florian.kauer@linutronix.de>

koalo force-pushed the devel/koalo/container-nosoap-stripped branch from f1a8feb to 7200369 Compare September 4, 2026 10:14


		# use /var/tmp to avoid filling up the RAM with large build artifacts
		os.environ.setdefault('TMPDIR', '/var/tmp')


		CHECK_BUILD_VARIANTS = ('schema', 'cdrom', 'img', 'sdk')

		@pytest.fixture(scope='module')



		@_register_action('insert_partition')
		class InsertPartitionAction(ImageFinetuningAction):

Uh oh!

Conversation

koalo commented Aug 25, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

t-8ch commented Sep 1, 2026

Uh oh!

koalo commented Sep 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants