From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 43770CD98C7 for ; Tue, 9 Jun 2026 17:31:29 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.1333727.1596907 (Exim 4.92) (envelope-from ) id 1wX0IA-00044G-ME; Tue, 09 Jun 2026 17:31:10 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1333727.1596907; Tue, 09 Jun 2026 17:31:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wX0IA-00043s-GZ; Tue, 09 Jun 2026 17:31:10 +0000 Received: by outflank-mailman (input) for mailman id 1333727; Tue, 09 Jun 2026 17:31:09 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) id 1wX0I9-0003pe-Cg for xen-devel@lists.xenproject.org; Tue, 09 Jun 2026 17:31:09 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wX0I8-005CfS-PD for xen-devel@lists.xenproject.org; Tue, 09 Jun 2026 19:31:08 +0200 Received: from [10.42.69.2] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a284dd2-5cb7-0a2a0a5109dd-0a2a45029f1e-20 for ; Tue, 09 Jun 2026 19:31:08 +0200 Received: from [209.85.128.43] (helo=mail-wm1-f43.google.com) by tlsNG-720697.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a284ddc-af86-0a2a45020019-d155802bdd4b-3 for ; Tue, 09 Jun 2026 19:31:08 +0200 Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-490d1e54b3bso21260295e9.1 for ; Tue, 09 Jun 2026 10:31:08 -0700 (PDT) Received: from localhost.localdomain (host-78-146-242-105.as13285.net. [78.146.242.105]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4601f351ac0sm113509696f8f.27.2026.06.09.10.31.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jun 2026 10:31:07 -0700 (PDT) X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=citrix.com header.i="@citrix.com" header.h="Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=google; t=1781026268; x=1781631068; darn=lists.xenproject.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=uaVpHtkT0XSlUk2rDGpamTLWDkRogaQpIZrdOR6KAfE=; b=jnl18aJGBa/my6FnXRAM8MUoOjy528yp/PAyLFC/vnJ275tnVIrMpvhJw+0DRbJeHu 0lCQp0/osWM0zjKKLY52X9yMhcLoQ8/hDWNUBoL293ht7iwIzdxKutLa1QgxI3g0kO1i 1TcLHOvSJuyyeeGvlhO8zCGp61zL8YJwjH98Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781026268; x=1781631068; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=uaVpHtkT0XSlUk2rDGpamTLWDkRogaQpIZrdOR6KAfE=; b=EZStuvT0NNdlANUH2/ex3QSiyY0+HECUZTKyVMLnCDoLQWiBayg7QN1Hr4k+bgMmao Vmx/5ofrXYMYVTD2FFa8E7Rb/0Lbj5s/+JJkJx5JgFEjeVCBS5ODw8+TcsArzhkCeTor sJxwzshFjlHZlPyG1VbmxC5YWosls/o3ojAR4BQuYXObH6ALPhghEKK3ad+iGcM+KOO9 Z0SkK+eACJUL34q4uxr6gegZKTs3m/w02je/rO5jt2dhnXSLdZBTMRp6gXrYs6g1EzyI 4NYy3pqh5C47lDDEGr3GdUskOcT8+8cw5XpnaOUsqPeHHAffV8stQgnPTmgfnd3Y3xtH saYQ== X-Gm-Message-State: AOJu0Yze86t4x5xzgd0gE1F/+m4Ncb+vciHqwk6RqVAYqX9Tcj+dsCCA OUMATx02m603r7cHvZvSH0067U61Y8wxiPQWe5xwYPYqzmGhwxbBCRV0QCB4UItq+PUZkPQ9x77 HVJbQ X-Gm-Gg: Acq92OFmKx3CJXBpHgruodHwU37j26EpkDPgVkrZe7Kp2SyS9cFbC8/0XTfjUydWRMA W8XbFK0Z9RbyS+uLKnkeo2BzBm0bhrjRc7LQtz8+qx2iPnHkYTfcpXEWWUgXF+Hwg6vQZ8KL8LU dg2ZZXPKcX7votticy3+GT6uwR1fJwxgymnubjAsan5Xti5RFSsb6nWIshIhxKWzLxdtkIKSwGm +rvRcv2o72DknCbn10i/ApdM66/95g/AoAvwrYG7R0iCFBtcAiwfNFstIamwJ9Vj0AY9+Ls9Rgg rMY1G8Qd2FglFvO++xC1+YsBhJomFiKnyqWK8mUfqtm02Xr/o2G/k+FeyxutxM7buYJYVFknplM 1W76s3mQNlImIV2V72mxyCo0RoQ7ZN079pxnnsBBznqqq+QMNK9DBubTMTP3Ya7HDzaiqkaTdh4 H3eG/co7faCZfks1uq3NQHTfekue4v/0vI4yHAAN2mGT2PMjNGwRXJLragl8kBrGY9K3EGRsgLU MBLbZ401gAPclQ= X-Received: by 2002:a05:600c:8183:b0:490:958c:46dc with SMTP id 5b1f17b1804b1-490c25b0a60mr316999875e9.17.1781026268063; Tue, 09 Jun 2026 10:31:08 -0700 (PDT) From: Andrew Cooper To: Xen-devel Cc: Andrew Cooper , Anthony PERARD , Stefano Stabellini , Michal Orzel , Doug Goldstein , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= , Oleksii Kurochko Subject: [PATCH 3/4] CI: Introduce new qubes-hw-runner.dockerfile Date: Tue, 9 Jun 2026 18:31:01 +0100 Message-Id: <20260609173102.2908514-4-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260609173102.2908514-1-andrew.cooper3@citrix.com> References: <20260609173102.2908514-1-andrew.cooper3@citrix.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-720697/1781026268-81D77161-E648CE47/10/63158204843 X-purgate-type: spam X-purgate-size: 2429 We want to make the build containers be non-root, but the hardware runner needs to continue being root. Split it out into a dedicated container. Intentionally give it a generic name so it need not change in the future. No practical change. Signed-off-by: Andrew Cooper --- CC: Anthony PERARD CC: Stefano Stabellini CC: Michal Orzel CC: Doug Goldstein CC: Roger Pau Monné CC: Marek Marczykowski-Górecki CC: Oleksii Kurochko I need to backport this patch to all trees (4.18 and later) before alpine:3.18-arm64v8 can be converted to be be non-root. In all other cases we've been renaming the containers to bypass this problem, but alpine:3.18-arm64v8 is in the correct new form. Alternatively, I could see about combining it with the Alpine update (which is long overdue and needs doing). --- .../build/alpine/qubes-hw-runner.dockerfile | 21 +++++++++++++++++++ automation/gitlab-ci/test.yaml | 2 +- 2 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 automation/build/alpine/qubes-hw-runner.dockerfile diff --git a/automation/build/alpine/qubes-hw-runner.dockerfile b/automation/build/alpine/qubes-hw-runner.dockerfile new file mode 100644 index 000000000000..0af17c6aabc6 --- /dev/null +++ b/automation/build/alpine/qubes-hw-runner.dockerfile @@ -0,0 +1,21 @@ +# syntax=docker/dockerfile:1 +FROM --platform=linux/arm64/v8 alpine:3.18 +LABEL maintainer.name="The Xen Project" +LABEL maintainer.email="xen-devel@lists.xenproject.org" + +RUN apk --no-cache add bash + +RUN <