From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7CDF606A31A for ; Thu, 29 Oct 2026 20:11:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=uFNHIAcX; dkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=PDDUAwlM; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=uFNHIAcX; dkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=PDDUAwlM Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xMWSf-0001xo-8D; Thu, 29 Oct 2026 16:10:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xMWSd-0001xb-IJ for qemu-devel@nongnu.org; Thu, 29 Oct 2026 16:10:55 -0400 Received: from smtp-out2.suse.de ([2a07:de40:b251:101:10:150:64:2]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1xMWSb-0003Hc-07 for qemu-devel@nongnu.org; Thu, 29 Oct 2026 16:10:54 -0400 Received: from imap1.dmz-prg2.suse.org (unknown [10.150.64.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id 6E9881FB17; Thu, 29 Oct 2026 20:10:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1793304649; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CHVIDR/icjN4YNnop6BtHaDPt/GN8Fm0sue29vU3zDs=; b=uFNHIAcXwbgSSpdCD12EhvmXrAYO2PGFjr9aVgEvy1GLlbShfAWl+TFJHeb+mkfnQ4ycBg SCViPVSYqLLnzlUXlCrOMoztDLaw8rafn6s9E/VBh55Jw/Ix9XaPIeGoJixAaeXKeD+B5L 0ceRkg0RlgHO+a3sFmqkZTc1wirAL2U= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1793304649; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CHVIDR/icjN4YNnop6BtHaDPt/GN8Fm0sue29vU3zDs=; b=PDDUAwlM68EFBVNdYXnpRu6Mvk836jvMlg2r/u3Y4F0uR75wriis6y8MkorD2Izyoeukgh 9DCuXcjM9+cKwGBQ== Authentication-Results: smtp-out2.suse.de; none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1793304649; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CHVIDR/icjN4YNnop6BtHaDPt/GN8Fm0sue29vU3zDs=; b=uFNHIAcXwbgSSpdCD12EhvmXrAYO2PGFjr9aVgEvy1GLlbShfAWl+TFJHeb+mkfnQ4ycBg SCViPVSYqLLnzlUXlCrOMoztDLaw8rafn6s9E/VBh55Jw/Ix9XaPIeGoJixAaeXKeD+B5L 0ceRkg0RlgHO+a3sFmqkZTc1wirAL2U= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1793304649; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CHVIDR/icjN4YNnop6BtHaDPt/GN8Fm0sue29vU3zDs=; b=PDDUAwlM68EFBVNdYXnpRu6Mvk836jvMlg2r/u3Y4F0uR75wriis6y8MkorD2Izyoeukgh 9DCuXcjM9+cKwGBQ== Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id E291E1342D; Thu, 29 Oct 2026 20:10:48 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id 3UdoIUio42pqKQAAD6G6ig (envelope-from ); Thu, 29 Oct 2026 20:10:48 +0000 From: Fabiano Rosas To: Pierrick Bouvier , qemu-devel@nongnu.org Cc: Alex =?utf-8?Q?Benn=C3=A9e?= , peterx@redhat.com, mjt@tls.msk.ru, Philippe =?utf-8?Q?Mathieu-Daud=C3=A9?= Subject: Re: [PATCH v5 1/2] tests/docker/dockerfiles: add release.docker In-Reply-To: References: <20261029000853.15166-1-pierrick.bouvier@oss.qualcomm.com> <20261029000853.15166-2-pierrick.bouvier@oss.qualcomm.com> <87ld7gin6q.fsf@suse.de> <7757e99b-0338-4508-b36f-9460d4efdb2f@oss.qualcomm.com> <87fqxoic5s.fsf@suse.de> <796b02d4-9cb0-4d04-a2cf-ca167fb01eb9@oss.qualcomm.com> <87cxssi9kr.fsf@suse.de> Date: Thu, 29 Oct 2026 17:10:42 -0300 Message-ID: <87a4nwi7y5.fsf@suse.de> X-Archived-By: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spamd-Result: default: False [-13.30 / 50.00]; SUSE_INTERNAL_BYPASS(-9.00)[]; BAYES_HAM(-3.00)[100.00%]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-0.20)[-1.000]; MIME_GOOD(-0.10)[text/plain]; MIME_TRACE(0.00)[0:+]; ARC_NA(0.00)[]; MISSING_XM_UA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; TO_DN_SOME(0.00)[]; RCVD_TLS_ALL(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; DKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_FIVE(0.00)[6]; FROM_EQ_ENVFROM(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; DBL_BLOCKED_OPENRESOLVER(0.00)[imap1.dmz-prg2.suse.org:helo, qualcomm.com:email, docker.io:url, suse.de:email, gitlab.com:url] X-Spam-Score: -13.30 Received-SPF: pass client-ip=2a07:de40:b251:101:10:150:64:2; envelope-from=farosas@suse.de; helo=smtp-out2.suse.de X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Archive: List-Post: List-Help: List-Subscribe: , Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org X-Spam-Status: No, score=-20.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on aws-us-west-2-korg-listserv-alma10-1 Pierrick Bouvier writes: > On 10/29/2026 11:35 AM, Fabiano Rosas wrote: >> Pierrick Bouvier writes: >>=20 >>> On 10/29/2026 10:39 AM, Fabiano Rosas wrote: >>>> Pierrick Bouvier writes: >>>> >>>>> On 10/29/2026 6:41 AM, Fabiano Rosas wrote: >>>>>> Pierrick Bouvier writes: >>>>>> >>>>>>> This new dockerfile allows to build a distroless image containing o= nly >>>>>>> qemu stripped release binaries, their lib dependencies, and install= ed >>>>>>> artifacts (roms, keymap, ...). There is no shell, no python, nothing >>>>>>> else. This is achieved thanks to a multi-stage build, where we add = qemu >>>>>>> binaries, artifacts and libraries in a new scratch image. Image has >>>>>>> the minimal size possible. >>>>>>> >>>>>>> This is based on Ubuntu, which has the advantage to have working >>>>>>> containers available down to 14.04. Debian old old stable have brok= en >>>>>>> apt sources for instance. >>>>>>> >>>>>>> This unique dockerfile works for all qemu versions >=3D 3.1.0 (2018= ). >>>>>>> We could build down to v0.12.0, but it would require more tweaks in= the >>>>>>> dockerfile, so we keep it simple instead. >>>>>>> >>>>>>> To build the image, you need to provide a qemu and ubuntu version: >>>>>>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=3Dv11= .1.0 --build-arg UBUNTU_VERSION=3D24.04 -t qemu/v11.1.0 >>>>>>> >>>>>>> To run it, as there is no shell, and no defined entrypoint, you nee= d to >>>>>>> choose the binary you want explicitely: >>>>>>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version >>>>>>> >>>>>>> Reviewed-by: Philippe Mathieu-Daud=C3=A9 >>>>>>> Reviewed-by: Fabiano Rosas >>>>>>> Signed-off-by: Pierrick Bouvier >>>>>>> --- >>>>>>> tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++= ++++ >>>>>>> 1 file changed, 48 insertions(+) >>>>>>> create mode 100644 tests/docker/dockerfiles/release.docker >>>>>>> >>>>>>> diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker= /dockerfiles/release.docker >>>>>>> new file mode 100644 >>>>>>> index 00000000000..ca6babde01e >>>>>>> --- /dev/null >>>>>>> +++ b/tests/docker/dockerfiles/release.docker >>>>>>> @@ -0,0 +1,48 @@ >>>>>>> +ARG UBUNTU_VERSION=3D"UBUNTU_VERSION_build_arg_must_be_set" >>>>>>> + >>>>>>> +FROM ubuntu:$UBUNTU_VERSION AS build >>>>>>> + >>>>>>> +# add deb-src for apt build-dep >>>>>>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.= list.d/* || true >>>>>>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list >>>>>>> +# archive.canonical.com is not reachable anymore, and cause a long= timeout >>>>>>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list >>>>>>> + >>>>>>> +# build dependencies >>>>>>> +RUN apt update && \ >>>>>>> +env DEBIAN_FRONTEND=3Dnoninteractive apt install -y git build-esse= ntial flex bison >>>>>>> +RUN apt update && \ >>>>>>> +env DEBIAN_FRONTEND=3Dnoninteractive apt build-dep -y --arch-only = qemu >>>>>>> + >>>>>>> +ARG QEMU_VERSION >>>>>>> +RUN echo "QEMU_VERSION=3D${QEMU_VERSION:?QEMU_VERSION build arg mu= st be set}" >>>>>>> +ARG QEMU_REPO=3D"https://gitlab.com/qemu-project/qemu.git" >>>>>>> + >>>>>>> +RUN cd /tmp && \ >>>>>>> +mkdir qemu && cd qemu && git init && \ >>>>>>> +git remote add origin "${QEMU_REPO}" && \ >>>>>>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \ >>>>>>> +git checkout FETCH_HEAD && \ >>>>>>> +./configure --prefix=3D/opt/qemu --disable-docs --disable-werror &= & \ >>>>>>> +make install -j $(nproc) && \ >>>>>>> +strip /opt/qemu/bin/* && \ >>>>>> >>>>>> For the record, here I included a 'cp /opt/qemu/bin' = line >>>>>> to make migration-test work from inside the container: >>>>>> >>>>>> migration-test >>>>>> sh >>>>>> env >>>>>> docker (installed as docker.io up there) >>>>>> cat >>>>>> >>>>> >>>>> You mean by mounting current folder in the container? >>>>> >>>> >>>> I mean having the test binary present in the container as well. >>>> >>>> This is something specific to migration compat testing: to avoid having >>>> issues due to features mismatches, we run the older version of >>>> migration-test when testing two different QEMU versions. >>>> >>>> But then... >>>> $ git checkout >>>> $ make check-build >>>> $ ./migration-test >>>> >>>> is kind of wasteful. I can simply build a container with QEMU + >>>> migration-test already in it and invoke: >>>> >>>> $ ./ >>>> >>> >>> Ok, I see. I'm not very familiar with migration testing, and assumed the >>> logic was opposite (that migration-test is backward compatible to test >>> from old versions). >>> >>=20 >> It was the original idea, but we noticed it was way easier to just pin >> the test. >> > > I guess there are good reasons for it, but it seems like it would be > much better to work from current HEAD instead of having to checkout and > build an older version of the test. There are advantages to using the old tests, maybe the main one is that we never need to think about older versions when writing the tests. What was there at the time is what's supported and that's it. If an old test breaks with a new QEMU, then the users will probably see the exact same breakage. > Flagging sub test per QEMU version does not seem too complex to > implement (min_version=3D8.0.x, so this test is skipped when running with > an older QEMU). > These are big integration tests that all run the entire migration process from end to end. If they were smaller unit tests, then it would be indeed simpler. But I confess we didn't try too hard. >>> But migration-test is not included in old container, since it's a test >>> binary (thus not installed). I feel that for this case, you need to >>> build from sources, at least to get migration-test-old. >>> >>=20 >> It's built inside the container along with QEMU. The cp line I added >> brings it over. >> > > Got you. > >>>>> I'm not against it, but I feel that if we go this way, it's just easi= er >>>>> to say "let's use the full base image", since it will become "I need = to >>>>> run python, and X, and Y, and Z". >>>>> >>>> >>>> I think we should merge this series as is. However if we intend to use >>>> it in the future for something more complex, something like the above >>>> will probably come up. Anyway, I posted literally "for the record". >>>> >>> >>> Sure, I'm just interested to make something useful for you. If it's half >>> baked, there is little value in merging this. >>> >>=20 >> I don't want to enlarge this container too much. In its current form >> it's also useful to others. >> > > Yes, I'll merge it as it is for now. > Yep, thanks again! >> For migration, we'd need the extra binaries I mentioned plus the output >> of -dump-vmstate to run ./scripts/vmstate-static-checker.py. It's >> probably better to have a separate container image with those. >> > > Regards, > Pierrick