Re: [PATCH v5 1/2] tests/docker/dockerfiles: add release.docker

[Fabiano Rosas <farosas@suse.de>]

Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:

> On 10/29/2026 10:39 AM, Fabiano Rosas wrote:
>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>> 
>>> On 10/29/2026 6:41 AM, Fabiano Rosas wrote:
>>>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>>>>
>>>>> This new dockerfile allows to build a distroless image containing only
>>>>> qemu stripped release binaries, their lib dependencies, and installed
>>>>> artifacts (roms, keymap, ...). There is no shell, no python, nothing
>>>>> else. This is achieved thanks to a multi-stage build, where we add qemu
>>>>> binaries, artifacts and libraries in a new scratch image. Image has
>>>>> the minimal size possible.
>>>>>
>>>>> This is based on Ubuntu, which has the advantage to have working
>>>>> containers available down to 14.04. Debian old old stable have broken
>>>>> apt sources for instance.
>>>>>
>>>>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018).
>>>>> We could build down to v0.12.0, but it would require more tweaks in the
>>>>> dockerfile, so we keep it simple instead.
>>>>>
>>>>> To build the image, you need to provide a qemu and ubuntu version:
>>>>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>>>>>
>>>>> To run it, as there is no shell, and no defined entrypoint, you need to
>>>>> choose the binary you want explicitely:
>>>>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
>>>>>
>>>>> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
>>>>> Reviewed-by: Fabiano Rosas <farosas@suse.de>
>>>>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
>>>>> ---
>>>>>  tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++
>>>>>  1 file changed, 48 insertions(+)
>>>>>  create mode 100644 tests/docker/dockerfiles/release.docker
>>>>>
>>>>> diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker/dockerfiles/release.docker
>>>>> new file mode 100644
>>>>> index 00000000000..ca6babde01e
>>>>> --- /dev/null
>>>>> +++ b/tests/docker/dockerfiles/release.docker
>>>>> @@ -0,0 +1,48 @@
>>>>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set"
>>>>> +
>>>>> +FROM ubuntu:$UBUNTU_VERSION AS build
>>>>> +
>>>>> +# add deb-src for apt build-dep
>>>>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* || true
>>>>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list
>>>>> +# archive.canonical.com is not reachable anymore, and cause a long timeout
>>>>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list
>>>>> +
>>>>> +# build dependencies
>>>>> +RUN apt update && \
>>>>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex bison
>>>>> +RUN apt update && \
>>>>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu
>>>>> +
>>>>> +ARG QEMU_VERSION
>>>>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}"
>>>>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"
>>>>> +
>>>>> +RUN cd /tmp && \
>>>>> +mkdir qemu && cd qemu && git init && \
>>>>> +git remote add origin "${QEMU_REPO}" && \
>>>>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \
>>>>> +git checkout FETCH_HEAD && \
>>>>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \
>>>>> +make install -j $(nproc) && \
>>>>> +strip /opt/qemu/bin/* && \
>>>>
>>>> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line
>>>> to make migration-test work from inside the container:
>>>>
>>>> migration-test
>>>> sh
>>>> env
>>>> docker (installed as docker.io up there)
>>>> cat
>>>>
>>>
>>> You mean by mounting current folder in the container?
>>>
>> 
>> I mean having the test binary present in the container as well.
>> 
>> This is something specific to migration compat testing: to avoid having
>> issues due to features mismatches, we run the older version of
>> migration-test when testing two different QEMU versions.
>> 
>> But then...
>> $ git checkout <old tag>
>> $ make check-build
>> $ ./migration-test <QEMU old container> <QEMU new container>
>> 
>> is kind of wasteful. I can simply build a container with QEMU +
>> migration-test already in it and invoke:
>> 
>> $ ./<migration-test old container> <QEMU old container> <QEMU new container>
>>
>
> Ok, I see. I'm not very familiar with migration testing, and assumed the
> logic was opposite (that migration-test is backward compatible to test
> from old versions).
>

It was the original idea, but we noticed it was way easier to just pin
the test.

> But migration-test is not included in old container, since it's a test
> binary (thus not installed). I feel that for this case, you need to
> build from sources, at least to get migration-test-old.
>

It's built inside the container along with QEMU. The cp line I added
brings it over.

>>> I'm not against it, but I feel that if we go this way, it's just easier
>>> to say "let's use the full base image", since it will become "I need to
>>> run python, and X, and Y, and Z".
>>>
>> 
>> I think we should merge this series as is. However if we intend to use
>> it in the future for something more complex, something like the above
>> will probably come up. Anyway, I posted literally "for the record".
>>
>
> Sure, I'm just interested to make something useful for you. If it's half
> baked, there is little value in merging this.
>

I don't want to enlarge this container too much. In its current form
it's also useful to others.

For migration, we'd need the extra binaries I mentioned plus the output
of -dump-vmstate to run ./scripts/vmstate-static-checker.py. It's
probably better to have a separate container image with those.

> Regards,
> Pierrick