[PATCH v5 0/2] releases: build and run any QEMU release easily!

[PATCH v5 0/2] releases: build and run any QEMU release easily!

[Pierrick Bouvier]

This series was inspired by a recent post from Fabiano to provide container
images for migration tests:
https://lore.kernel.org/qemu-devel/24d04a1f-344d-4b90-a307-b582dd9a1128@oss.qualcomm.com/T/#m353f119dc1a24fa437dde8a96d1891629e64303c

The idea to be able to build and run any QEMU (past) release with containers was
in my mind for some time, so I gave it a shot. Finally, it was easier than
expected to obtain a single dockerfile (with a few hacks) that works over all
our releases.

Images have the absolute minimal content possible. It's only qemu binaries,
artifacts (roms, keymap, ...), and libraries. There is no shell or any other
tool included. As a result, images have a size from 581MB (v3.1.0) to 1.1GB
(v11.1.2).

This series adds:
- a unique dockerfile to build any QEMU release. User has to provide an explicit
  Ubuntu version when building a given QEMU version.
- A script build_release_container.sh which automatically detects which ubuntu
  version a given release should be buildable on (based on date). It works
  great, and the heuristic works for all our versions.

TLDR:
$ ./scripts/build_release_container.sh v3.1.0
$ podman run -it --rm qemu/v3.1.0 qemu-system-arm --version

v5
--

- fix build with docker (missing context)

v4
--

- supports build for any version (tag or sha-1)
- adds an optional parameter to build_release_container.sh to use an alternative
  URL for QEMU repo
- simplified Dockerfile by supporting any version >= 3.1.0.
- removed patch 3 generating wrappers to published docker images

v3
--

- extend dockerfile to support ubuntu 12.04, and lower older revision we can
  build from v1.6.1 to v0.12.0.

v2
--

- fix generate_release_links.sh: was missing userns option for podman
- dockerfile: cleanup "|| true" and replaced with proper ifs

Pierrick Bouvier (2):
  tests/docker/dockerfiles: add release.docker
  scripts: add build_release_container.sh

 scripts/build_release_container.sh      | 63 +++++++++++++++++++++++++
 tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++
 2 files changed, 111 insertions(+)
 create mode 100755 scripts/build_release_container.sh
 create mode 100644 tests/docker/dockerfiles/release.docker

-- 
2.43.0

[PATCH v5 1/2] tests/docker/dockerfiles: add release.docker

[Pierrick Bouvier]

This new dockerfile allows to build a distroless image containing only
qemu stripped release binaries, their lib dependencies, and installed
artifacts (roms, keymap, ...). There is no shell, no python, nothing
else. This is achieved thanks to a multi-stage build, where we add qemu
binaries, artifacts and libraries in a new scratch image. Image has
the minimal size possible.

This is based on Ubuntu, which has the advantage to have working
containers available down to 14.04. Debian old old stable have broken
apt sources for instance.

This unique dockerfile works for all qemu versions >= 3.1.0 (2018).
We could build down to v0.12.0, but it would require more tweaks in the
dockerfile, so we keep it simple instead.

To build the image, you need to provide a qemu and ubuntu version:
$ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0

To run it, as there is no shell, and no defined entrypoint, you need to
choose the binary you want explicitely:
$ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
---
 tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 tests/docker/dockerfiles/release.docker

diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker/dockerfiles/release.docker
new file mode 100644
index 00000000000..ca6babde01e
--- /dev/null
+++ b/tests/docker/dockerfiles/release.docker
@@ -0,0 +1,48 @@
+ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set"
+
+FROM ubuntu:$UBUNTU_VERSION AS build
+
+# add deb-src for apt build-dep
+RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* || true
+RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list
+# archive.canonical.com is not reachable anymore, and cause a long timeout
+RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list
+
+# build dependencies
+RUN apt update && \
+env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex bison
+RUN apt update && \
+env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu
+
+ARG QEMU_VERSION
+RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}"
+ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"
+
+RUN cd /tmp && \
+mkdir qemu && cd qemu && git init && \
+git remote add origin "${QEMU_REPO}" && \
+git fetch origin "${QEMU_VERSION}" --depth 1 && \
+git checkout FETCH_HEAD && \
+./configure --prefix=/opt/qemu --disable-docs --disable-werror && \
+make install -j $(nproc) && \
+strip /opt/qemu/bin/* && \
+rm -rf /tmp/*
+
+# retrieve runtime dependencies (libs)
+RUN ldd /opt/qemu/bin/* | grep '=>' | sed -e 's/.*=>//' -e 's/(.*//' | sort -u > /opt/qemu/libs
+# store them in /deps/lib
+RUN mkdir -p /deps/lib && cp --preserve --dereference $(cat /opt/qemu/libs) /deps/lib
+# copy loader (with its original path)
+RUN cp --preserve --parents --dereference /lib*/ld-linux* /deps/
+
+################################################################################
+FROM scratch
+
+COPY --from=build /deps /
+# copy qemu and all associated artifacts (roms, ...)
+COPY --from=build /opt/qemu /usr
+
+# build with:
+# podman build -f release.docker --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
+# run with:
+# podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
-- 
2.43.0

[PATCH v5 2/2] scripts: add build_release_container.sh

[Pierrick Bouvier]

This script allows to easily build a qemu release container, based on
dockerfile introduced in previous commit.

It names image "qemu/$version" and automatically detects which ubuntu
version should be used to build it.

$ ./scripts/build_release_container.sh v3.1.0
$ podman run -it --rm qemu/v3.1.0 qemu-system-arm --version
QEMU emulator version 3.1.0 (-dirty)
Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
---
 scripts/build_release_container.sh | 63 ++++++++++++++++++++++++++++++
 1 file changed, 63 insertions(+)
 create mode 100755 scripts/build_release_container.sh

diff --git a/scripts/build_release_container.sh b/scripts/build_release_container.sh
new file mode 100755
index 00000000000..7dd477deea8
--- /dev/null
+++ b/scripts/build_release_container.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+set -euo pipefail
+
+script_dir=$(dirname $(readlink -f $0))
+
+# The oldest buildable release we support is v3.1.0, as previous ones require
+# additional tweaks in Dockerfile.
+# For building previous releases (down to v0.12.0),
+# see: 20261014005338.34657-1-pierrick.bouvier@oss.qualcomm.com
+oldest_release=v3.1.0
+
+if [ $# -lt 1 ] || [ $# -gt 2 ]; then
+    echo "usage: version [git_repo]"
+    echo
+    echo "- version: tag or sha-1 (>= v3.1.0)"
+    echo "- git_repo: (optional) QEMU repository URL"
+    exit 1
+fi
+version=$1;shift
+
+git_repo="https://gitlab.com/qemu-project/qemu.git"
+if [ $# -eq 1 ]; then
+    git_repo=$1;shift
+fi
+
+year=$(date +%Y)
+month=$(date +%m)
+if git rev-parse $version >& /dev/null; then
+    year=$(git log -1 --format='%cd' --date='format:%Y' $version)
+    month=$(git log -1 --format='%cd' --date='format:%m' $version)
+fi
+
+# Ubuntu LTS are published every (even) two years in April.
+ubuntu=
+if [ $((year % 2)) -eq 1 ]; then
+    # pick latest LTS from previous year
+    ubuntu=$((year - 1))
+elif [ $month -gt 6 ]; then
+    # LTS published this year should work
+    ubuntu=$year
+else
+    # pick latest LTS from two years ago
+    ubuntu=$((year - 2))
+fi
+if [ $ubuntu -lt 2014 ]; then
+    # oldest ubuntu release available with containers is 14.04
+    ubuntu=2014
+fi
+ubuntu=$((ubuntu - 2000))
+ubuntu_version=$ubuntu.04
+
+dockerfile=$script_dir/../tests/docker/dockerfiles/release.docker
+docker=$($script_dir/../tests/docker/docker.py probe)
+
+set -x
+$docker build . \
+    -f $dockerfile \
+    --build-arg QEMU_VERSION=$version \
+    --build-arg UBUNTU_VERSION=$ubuntu_version \
+    --build-arg QEMU_REPO="$git_repo" \
+    -t qemu/$version
-- 
2.43.0

Re: [PATCH v5 1/2] tests/docker/dockerfiles: add release.docker

[Fabiano Rosas]

Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:

> This new dockerfile allows to build a distroless image containing only
> qemu stripped release binaries, their lib dependencies, and installed
> artifacts (roms, keymap, ...). There is no shell, no python, nothing
> else. This is achieved thanks to a multi-stage build, where we add qemu
> binaries, artifacts and libraries in a new scratch image. Image has
> the minimal size possible.
>
> This is based on Ubuntu, which has the advantage to have working
> containers available down to 14.04. Debian old old stable have broken
> apt sources for instance.
>
> This unique dockerfile works for all qemu versions >= 3.1.0 (2018).
> We could build down to v0.12.0, but it would require more tweaks in the
> dockerfile, so we keep it simple instead.
>
> To build the image, you need to provide a qemu and ubuntu version:
> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>
> To run it, as there is no shell, and no defined entrypoint, you need to
> choose the binary you want explicitely:
> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
> Reviewed-by: Fabiano Rosas <farosas@suse.de>
> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
> ---
>  tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++
>  1 file changed, 48 insertions(+)
>  create mode 100644 tests/docker/dockerfiles/release.docker
>
> diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker/dockerfiles/release.docker
> new file mode 100644
> index 00000000000..ca6babde01e
> --- /dev/null
> +++ b/tests/docker/dockerfiles/release.docker
> @@ -0,0 +1,48 @@
> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set"
> +
> +FROM ubuntu:$UBUNTU_VERSION AS build
> +
> +# add deb-src for apt build-dep
> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* || true
> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list
> +# archive.canonical.com is not reachable anymore, and cause a long timeout
> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list
> +
> +# build dependencies
> +RUN apt update && \
> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex bison
> +RUN apt update && \
> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu
> +
> +ARG QEMU_VERSION
> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}"
> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"
> +
> +RUN cd /tmp && \
> +mkdir qemu && cd qemu && git init && \
> +git remote add origin "${QEMU_REPO}" && \
> +git fetch origin "${QEMU_VERSION}" --depth 1 && \
> +git checkout FETCH_HEAD && \
> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \
> +make install -j $(nproc) && \
> +strip /opt/qemu/bin/* && \

For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line
to make migration-test work from inside the container:

migration-test
sh
env
docker (installed as docker.io up there)
cat

> +rm -rf /tmp/*
> +
> +# retrieve runtime dependencies (libs)
> +RUN ldd /opt/qemu/bin/* | grep '=>' | sed -e 's/.*=>//' -e 's/(.*//' | sort -u > /opt/qemu/libs
> +# store them in /deps/lib
> +RUN mkdir -p /deps/lib && cp --preserve --dereference $(cat /opt/qemu/libs) /deps/lib
> +# copy loader (with its original path)
> +RUN cp --preserve --parents --dereference /lib*/ld-linux* /deps/
> +
> +################################################################################
> +FROM scratch
> +
> +COPY --from=build /deps /
> +# copy qemu and all associated artifacts (roms, ...)
> +COPY --from=build /opt/qemu /usr
> +
> +# build with:
> +# podman build -f release.docker --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
> +# run with:
> +# podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version

Re: [PATCH v5 2/2] scripts: add build_release_container.sh

[Fabiano Rosas]

Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:

> This script allows to easily build a qemu release container, based on
> dockerfile introduced in previous commit.
>
> It names image "qemu/$version" and automatically detects which ubuntu
> version should be used to build it.
>
> $ ./scripts/build_release_container.sh v3.1.0
> $ podman run -it --rm qemu/v3.1.0 qemu-system-arm --version
> QEMU emulator version 3.1.0 (-dirty)
> Copyright (c) 2003-2018 Fabrice Bellard and the QEMU Project developers
>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
> ---
>  scripts/build_release_container.sh | 63 ++++++++++++++++++++++++++++++
>  1 file changed, 63 insertions(+)
>  create mode 100755 scripts/build_release_container.sh
>
> diff --git a/scripts/build_release_container.sh b/scripts/build_release_container.sh
> new file mode 100755
> index 00000000000..7dd477deea8
> --- /dev/null
> +++ b/scripts/build_release_container.sh
> @@ -0,0 +1,63 @@
> +#!/usr/bin/env bash
> +# SPDX-License-Identifier: GPL-2.0-or-later
> +
> +set -euo pipefail
> +
> +script_dir=$(dirname $(readlink -f $0))
> +
> +# The oldest buildable release we support is v3.1.0, as previous ones require
> +# additional tweaks in Dockerfile.
> +# For building previous releases (down to v0.12.0),
> +# see: 20261014005338.34657-1-pierrick.bouvier@oss.qualcomm.com
> +oldest_release=v3.1.0
> +
> +if [ $# -lt 1 ] || [ $# -gt 2 ]; then
> +    echo "usage: version [git_repo]"
> +    echo
> +    echo "- version: tag or sha-1 (>= v3.1.0)"
> +    echo "- git_repo: (optional) QEMU repository URL"
> +    exit 1
> +fi
> +version=$1;shift
> +
> +git_repo="https://gitlab.com/qemu-project/qemu.git"
> +if [ $# -eq 1 ]; then
> +    git_repo=$1;shift
> +fi
> +
> +year=$(date +%Y)
> +month=$(date +%m)
> +if git rev-parse $version >& /dev/null; then
> +    year=$(git log -1 --format='%cd' --date='format:%Y' $version)
> +    month=$(git log -1 --format='%cd' --date='format:%m' $version)
> +fi
> +
> +# Ubuntu LTS are published every (even) two years in April.
> +ubuntu=
> +if [ $((year % 2)) -eq 1 ]; then
> +    # pick latest LTS from previous year
> +    ubuntu=$((year - 1))
> +elif [ $month -gt 6 ]; then
> +    # LTS published this year should work
> +    ubuntu=$year
> +else
> +    # pick latest LTS from two years ago
> +    ubuntu=$((year - 2))
> +fi
> +if [ $ubuntu -lt 2014 ]; then
> +    # oldest ubuntu release available with containers is 14.04
> +    ubuntu=2014
> +fi
> +ubuntu=$((ubuntu - 2000))
> +ubuntu_version=$ubuntu.04
> +
> +dockerfile=$script_dir/../tests/docker/dockerfiles/release.docker
> +docker=$($script_dir/../tests/docker/docker.py probe)
> +
> +set -x
> +$docker build . \
> +    -f $dockerfile \
> +    --build-arg QEMU_VERSION=$version \
> +    --build-arg UBUNTU_VERSION=$ubuntu_version \
> +    --build-arg QEMU_REPO="$git_repo" \
> +    -t qemu/$version

I have successfully tested the migration-next branch with this
series. It's a great improvement over what I had before. Thank you for
this work.

Reviewed-by: Fabiano Rosas <farosas@suse.de>

Re: [PATCH v5 1/2] tests/docker/dockerfiles: add release.docker

[Pierrick Bouvier]

On 10/29/2026 6:41 AM, Fabiano Rosas wrote:
> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
> 
>> This new dockerfile allows to build a distroless image containing only
>> qemu stripped release binaries, their lib dependencies, and installed
>> artifacts (roms, keymap, ...). There is no shell, no python, nothing
>> else. This is achieved thanks to a multi-stage build, where we add qemu
>> binaries, artifacts and libraries in a new scratch image. Image has
>> the minimal size possible.
>>
>> This is based on Ubuntu, which has the advantage to have working
>> containers available down to 14.04. Debian old old stable have broken
>> apt sources for instance.
>>
>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018).
>> We could build down to v0.12.0, but it would require more tweaks in the
>> dockerfile, so we keep it simple instead.
>>
>> To build the image, you need to provide a qemu and ubuntu version:
>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>>
>> To run it, as there is no shell, and no defined entrypoint, you need to
>> choose the binary you want explicitely:
>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
>>
>> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
>> Reviewed-by: Fabiano Rosas <farosas@suse.de>
>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
>> ---
>>  tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++
>>  1 file changed, 48 insertions(+)
>>  create mode 100644 tests/docker/dockerfiles/release.docker
>>
>> diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker/dockerfiles/release.docker
>> new file mode 100644
>> index 00000000000..ca6babde01e
>> --- /dev/null
>> +++ b/tests/docker/dockerfiles/release.docker
>> @@ -0,0 +1,48 @@
>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set"
>> +
>> +FROM ubuntu:$UBUNTU_VERSION AS build
>> +
>> +# add deb-src for apt build-dep
>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* || true
>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list
>> +# archive.canonical.com is not reachable anymore, and cause a long timeout
>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list
>> +
>> +# build dependencies
>> +RUN apt update && \
>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex bison
>> +RUN apt update && \
>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu
>> +
>> +ARG QEMU_VERSION
>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}"
>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"
>> +
>> +RUN cd /tmp && \
>> +mkdir qemu && cd qemu && git init && \
>> +git remote add origin "${QEMU_REPO}" && \
>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \
>> +git checkout FETCH_HEAD && \
>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \
>> +make install -j $(nproc) && \
>> +strip /opt/qemu/bin/* && \
> 
> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line
> to make migration-test work from inside the container:
> 
> migration-test
> sh
> env
> docker (installed as docker.io up there)
> cat
>

You mean by mounting current folder in the container?

I'm not against it, but I feel that if we go this way, it's just easier
to say "let's use the full base image", since it will become "I need to
run python, and X, and Y, and Z".

What is missing to just use the container as a binary, instead of having
to mount anything inside it?

>> +rm -rf /tmp/*
>> +
>> +# retrieve runtime dependencies (libs)
>> +RUN ldd /opt/qemu/bin/* | grep '=>' | sed -e 's/.*=>//' -e 's/(.*//' | sort -u > /opt/qemu/libs
>> +# store them in /deps/lib
>> +RUN mkdir -p /deps/lib && cp --preserve --dereference $(cat /opt/qemu/libs) /deps/lib
>> +# copy loader (with its original path)
>> +RUN cp --preserve --parents --dereference /lib*/ld-linux* /deps/
>> +
>> +################################################################################
>> +FROM scratch
>> +
>> +COPY --from=build /deps /
>> +# copy qemu and all associated artifacts (roms, ...)
>> +COPY --from=build /opt/qemu /usr
>> +
>> +# build with:
>> +# podman build -f release.docker --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>> +# run with:
>> +# podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version

Re: [PATCH v5 1/2] tests/docker/dockerfiles: add release.docker

[Fabiano Rosas]

Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:

> On 10/29/2026 6:41 AM, Fabiano Rosas wrote:
>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>> 
>>> This new dockerfile allows to build a distroless image containing only
>>> qemu stripped release binaries, their lib dependencies, and installed
>>> artifacts (roms, keymap, ...). There is no shell, no python, nothing
>>> else. This is achieved thanks to a multi-stage build, where we add qemu
>>> binaries, artifacts and libraries in a new scratch image. Image has
>>> the minimal size possible.
>>>
>>> This is based on Ubuntu, which has the advantage to have working
>>> containers available down to 14.04. Debian old old stable have broken
>>> apt sources for instance.
>>>
>>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018).
>>> We could build down to v0.12.0, but it would require more tweaks in the
>>> dockerfile, so we keep it simple instead.
>>>
>>> To build the image, you need to provide a qemu and ubuntu version:
>>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>>>
>>> To run it, as there is no shell, and no defined entrypoint, you need to
>>> choose the binary you want explicitely:
>>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
>>>
>>> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
>>> Reviewed-by: Fabiano Rosas <farosas@suse.de>
>>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
>>> ---
>>>  tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++
>>>  1 file changed, 48 insertions(+)
>>>  create mode 100644 tests/docker/dockerfiles/release.docker
>>>
>>> diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker/dockerfiles/release.docker
>>> new file mode 100644
>>> index 00000000000..ca6babde01e
>>> --- /dev/null
>>> +++ b/tests/docker/dockerfiles/release.docker
>>> @@ -0,0 +1,48 @@
>>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set"
>>> +
>>> +FROM ubuntu:$UBUNTU_VERSION AS build
>>> +
>>> +# add deb-src for apt build-dep
>>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* || true
>>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list
>>> +# archive.canonical.com is not reachable anymore, and cause a long timeout
>>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list
>>> +
>>> +# build dependencies
>>> +RUN apt update && \
>>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex bison
>>> +RUN apt update && \
>>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu
>>> +
>>> +ARG QEMU_VERSION
>>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}"
>>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"
>>> +
>>> +RUN cd /tmp && \
>>> +mkdir qemu && cd qemu && git init && \
>>> +git remote add origin "${QEMU_REPO}" && \
>>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \
>>> +git checkout FETCH_HEAD && \
>>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \
>>> +make install -j $(nproc) && \
>>> +strip /opt/qemu/bin/* && \
>> 
>> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line
>> to make migration-test work from inside the container:
>> 
>> migration-test
>> sh
>> env
>> docker (installed as docker.io up there)
>> cat
>>
>
> You mean by mounting current folder in the container?
>

I mean having the test binary present in the container as well.

This is something specific to migration compat testing: to avoid having
issues due to features mismatches, we run the older version of
migration-test when testing two different QEMU versions.

But then...
$ git checkout <old tag>
$ make check-build
$ ./migration-test <QEMU old container> <QEMU new container>

is kind of wasteful. I can simply build a container with QEMU +
migration-test already in it and invoke:

$ ./<migration-test old container> <QEMU old container> <QEMU new container>

> I'm not against it, but I feel that if we go this way, it's just easier
> to say "let's use the full base image", since it will become "I need to
> run python, and X, and Y, and Z".
>

I think we should merge this series as is. However if we intend to use
it in the future for something more complex, something like the above
will probably come up. Anyway, I posted literally "for the record".

> What is missing to just use the container as a binary, instead of having
> to mount anything inside it?
>
>>> +rm -rf /tmp/*
>>> +
>>> +# retrieve runtime dependencies (libs)
>>> +RUN ldd /opt/qemu/bin/* | grep '=>' | sed -e 's/.*=>//' -e 's/(.*//' | sort -u > /opt/qemu/libs
>>> +# store them in /deps/lib
>>> +RUN mkdir -p /deps/lib && cp --preserve --dereference $(cat /opt/qemu/libs) /deps/lib
>>> +# copy loader (with its original path)
>>> +RUN cp --preserve --parents --dereference /lib*/ld-linux* /deps/
>>> +
>>> +################################################################################
>>> +FROM scratch
>>> +
>>> +COPY --from=build /deps /
>>> +# copy qemu and all associated artifacts (roms, ...)
>>> +COPY --from=build /opt/qemu /usr
>>> +
>>> +# build with:
>>> +# podman build -f release.docker --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>>> +# run with:
>>> +# podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version

Re: [PATCH v5 1/2] tests/docker/dockerfiles: add release.docker

[Pierrick Bouvier]

On 10/29/2026 10:39 AM, Fabiano Rosas wrote:
> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
> 
>> On 10/29/2026 6:41 AM, Fabiano Rosas wrote:
>>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>>>
>>>> This new dockerfile allows to build a distroless image containing only
>>>> qemu stripped release binaries, their lib dependencies, and installed
>>>> artifacts (roms, keymap, ...). There is no shell, no python, nothing
>>>> else. This is achieved thanks to a multi-stage build, where we add qemu
>>>> binaries, artifacts and libraries in a new scratch image. Image has
>>>> the minimal size possible.
>>>>
>>>> This is based on Ubuntu, which has the advantage to have working
>>>> containers available down to 14.04. Debian old old stable have broken
>>>> apt sources for instance.
>>>>
>>>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018).
>>>> We could build down to v0.12.0, but it would require more tweaks in the
>>>> dockerfile, so we keep it simple instead.
>>>>
>>>> To build the image, you need to provide a qemu and ubuntu version:
>>>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>>>>
>>>> To run it, as there is no shell, and no defined entrypoint, you need to
>>>> choose the binary you want explicitely:
>>>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
>>>>
>>>> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
>>>> Reviewed-by: Fabiano Rosas <farosas@suse.de>
>>>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
>>>> ---
>>>>  tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++
>>>>  1 file changed, 48 insertions(+)
>>>>  create mode 100644 tests/docker/dockerfiles/release.docker
>>>>
>>>> diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker/dockerfiles/release.docker
>>>> new file mode 100644
>>>> index 00000000000..ca6babde01e
>>>> --- /dev/null
>>>> +++ b/tests/docker/dockerfiles/release.docker
>>>> @@ -0,0 +1,48 @@
>>>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set"
>>>> +
>>>> +FROM ubuntu:$UBUNTU_VERSION AS build
>>>> +
>>>> +# add deb-src for apt build-dep
>>>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* || true
>>>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list
>>>> +# archive.canonical.com is not reachable anymore, and cause a long timeout
>>>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list
>>>> +
>>>> +# build dependencies
>>>> +RUN apt update && \
>>>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex bison
>>>> +RUN apt update && \
>>>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu
>>>> +
>>>> +ARG QEMU_VERSION
>>>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}"
>>>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"
>>>> +
>>>> +RUN cd /tmp && \
>>>> +mkdir qemu && cd qemu && git init && \
>>>> +git remote add origin "${QEMU_REPO}" && \
>>>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \
>>>> +git checkout FETCH_HEAD && \
>>>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \
>>>> +make install -j $(nproc) && \
>>>> +strip /opt/qemu/bin/* && \
>>>
>>> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line
>>> to make migration-test work from inside the container:
>>>
>>> migration-test
>>> sh
>>> env
>>> docker (installed as docker.io up there)
>>> cat
>>>
>>
>> You mean by mounting current folder in the container?
>>
> 
> I mean having the test binary present in the container as well.
> 
> This is something specific to migration compat testing: to avoid having
> issues due to features mismatches, we run the older version of
> migration-test when testing two different QEMU versions.
> 
> But then...
> $ git checkout <old tag>
> $ make check-build
> $ ./migration-test <QEMU old container> <QEMU new container>
> 
> is kind of wasteful. I can simply build a container with QEMU +
> migration-test already in it and invoke:
> 
> $ ./<migration-test old container> <QEMU old container> <QEMU new container>
>

Ok, I see. I'm not very familiar with migration testing, and assumed the
logic was opposite (that migration-test is backward compatible to test
from old versions).

But migration-test is not included in old container, since it's a test
binary (thus not installed). I feel that for this case, you need to
build from sources, at least to get migration-test-old.

>> I'm not against it, but I feel that if we go this way, it's just easier
>> to say "let's use the full base image", since it will become "I need to
>> run python, and X, and Y, and Z".
>>
> 
> I think we should merge this series as is. However if we intend to use
> it in the future for something more complex, something like the above
> will probably come up. Anyway, I posted literally "for the record".
>

Sure, I'm just interested to make something useful for you. If it's half
baked, there is little value in merging this.

Regards,
Pierrick

Re: [PATCH v5 1/2] tests/docker/dockerfiles: add release.docker

[Fabiano Rosas]

Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:

> On 10/29/2026 10:39 AM, Fabiano Rosas wrote:
>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>> 
>>> On 10/29/2026 6:41 AM, Fabiano Rosas wrote:
>>>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>>>>
>>>>> This new dockerfile allows to build a distroless image containing only
>>>>> qemu stripped release binaries, their lib dependencies, and installed
>>>>> artifacts (roms, keymap, ...). There is no shell, no python, nothing
>>>>> else. This is achieved thanks to a multi-stage build, where we add qemu
>>>>> binaries, artifacts and libraries in a new scratch image. Image has
>>>>> the minimal size possible.
>>>>>
>>>>> This is based on Ubuntu, which has the advantage to have working
>>>>> containers available down to 14.04. Debian old old stable have broken
>>>>> apt sources for instance.
>>>>>
>>>>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018).
>>>>> We could build down to v0.12.0, but it would require more tweaks in the
>>>>> dockerfile, so we keep it simple instead.
>>>>>
>>>>> To build the image, you need to provide a qemu and ubuntu version:
>>>>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>>>>>
>>>>> To run it, as there is no shell, and no defined entrypoint, you need to
>>>>> choose the binary you want explicitely:
>>>>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
>>>>>
>>>>> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
>>>>> Reviewed-by: Fabiano Rosas <farosas@suse.de>
>>>>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
>>>>> ---
>>>>>  tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++
>>>>>  1 file changed, 48 insertions(+)
>>>>>  create mode 100644 tests/docker/dockerfiles/release.docker
>>>>>
>>>>> diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker/dockerfiles/release.docker
>>>>> new file mode 100644
>>>>> index 00000000000..ca6babde01e
>>>>> --- /dev/null
>>>>> +++ b/tests/docker/dockerfiles/release.docker
>>>>> @@ -0,0 +1,48 @@
>>>>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set"
>>>>> +
>>>>> +FROM ubuntu:$UBUNTU_VERSION AS build
>>>>> +
>>>>> +# add deb-src for apt build-dep
>>>>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* || true
>>>>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list
>>>>> +# archive.canonical.com is not reachable anymore, and cause a long timeout
>>>>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list
>>>>> +
>>>>> +# build dependencies
>>>>> +RUN apt update && \
>>>>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex bison
>>>>> +RUN apt update && \
>>>>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu
>>>>> +
>>>>> +ARG QEMU_VERSION
>>>>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}"
>>>>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"
>>>>> +
>>>>> +RUN cd /tmp && \
>>>>> +mkdir qemu && cd qemu && git init && \
>>>>> +git remote add origin "${QEMU_REPO}" && \
>>>>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \
>>>>> +git checkout FETCH_HEAD && \
>>>>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \
>>>>> +make install -j $(nproc) && \
>>>>> +strip /opt/qemu/bin/* && \
>>>>
>>>> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line
>>>> to make migration-test work from inside the container:
>>>>
>>>> migration-test
>>>> sh
>>>> env
>>>> docker (installed as docker.io up there)
>>>> cat
>>>>
>>>
>>> You mean by mounting current folder in the container?
>>>
>> 
>> I mean having the test binary present in the container as well.
>> 
>> This is something specific to migration compat testing: to avoid having
>> issues due to features mismatches, we run the older version of
>> migration-test when testing two different QEMU versions.
>> 
>> But then...
>> $ git checkout <old tag>
>> $ make check-build
>> $ ./migration-test <QEMU old container> <QEMU new container>
>> 
>> is kind of wasteful. I can simply build a container with QEMU +
>> migration-test already in it and invoke:
>> 
>> $ ./<migration-test old container> <QEMU old container> <QEMU new container>
>>
>
> Ok, I see. I'm not very familiar with migration testing, and assumed the
> logic was opposite (that migration-test is backward compatible to test
> from old versions).
>

It was the original idea, but we noticed it was way easier to just pin
the test.

> But migration-test is not included in old container, since it's a test
> binary (thus not installed). I feel that for this case, you need to
> build from sources, at least to get migration-test-old.
>

It's built inside the container along with QEMU. The cp line I added
brings it over.

>>> I'm not against it, but I feel that if we go this way, it's just easier
>>> to say "let's use the full base image", since it will become "I need to
>>> run python, and X, and Y, and Z".
>>>
>> 
>> I think we should merge this series as is. However if we intend to use
>> it in the future for something more complex, something like the above
>> will probably come up. Anyway, I posted literally "for the record".
>>
>
> Sure, I'm just interested to make something useful for you. If it's half
> baked, there is little value in merging this.
>

I don't want to enlarge this container too much. In its current form
it's also useful to others.

For migration, we'd need the extra binaries I mentioned plus the output
of -dump-vmstate to run ./scripts/vmstate-static-checker.py. It's
probably better to have a separate container image with those.

> Regards,
> Pierrick

Re: [PATCH v5 1/2] tests/docker/dockerfiles: add release.docker

[Pierrick Bouvier]

On 10/29/2026 11:35 AM, Fabiano Rosas wrote:
> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
> 
>> On 10/29/2026 10:39 AM, Fabiano Rosas wrote:
>>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>>>
>>>> On 10/29/2026 6:41 AM, Fabiano Rosas wrote:
>>>>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>>>>>
>>>>>> This new dockerfile allows to build a distroless image containing only
>>>>>> qemu stripped release binaries, their lib dependencies, and installed
>>>>>> artifacts (roms, keymap, ...). There is no shell, no python, nothing
>>>>>> else. This is achieved thanks to a multi-stage build, where we add qemu
>>>>>> binaries, artifacts and libraries in a new scratch image. Image has
>>>>>> the minimal size possible.
>>>>>>
>>>>>> This is based on Ubuntu, which has the advantage to have working
>>>>>> containers available down to 14.04. Debian old old stable have broken
>>>>>> apt sources for instance.
>>>>>>
>>>>>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018).
>>>>>> We could build down to v0.12.0, but it would require more tweaks in the
>>>>>> dockerfile, so we keep it simple instead.
>>>>>>
>>>>>> To build the image, you need to provide a qemu and ubuntu version:
>>>>>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>>>>>>
>>>>>> To run it, as there is no shell, and no defined entrypoint, you need to
>>>>>> choose the binary you want explicitely:
>>>>>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
>>>>>>
>>>>>> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
>>>>>> Reviewed-by: Fabiano Rosas <farosas@suse.de>
>>>>>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
>>>>>> ---
>>>>>>  tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++
>>>>>>  1 file changed, 48 insertions(+)
>>>>>>  create mode 100644 tests/docker/dockerfiles/release.docker
>>>>>>
>>>>>> diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker/dockerfiles/release.docker
>>>>>> new file mode 100644
>>>>>> index 00000000000..ca6babde01e
>>>>>> --- /dev/null
>>>>>> +++ b/tests/docker/dockerfiles/release.docker
>>>>>> @@ -0,0 +1,48 @@
>>>>>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set"
>>>>>> +
>>>>>> +FROM ubuntu:$UBUNTU_VERSION AS build
>>>>>> +
>>>>>> +# add deb-src for apt build-dep
>>>>>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* || true
>>>>>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list
>>>>>> +# archive.canonical.com is not reachable anymore, and cause a long timeout
>>>>>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list
>>>>>> +
>>>>>> +# build dependencies
>>>>>> +RUN apt update && \
>>>>>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex bison
>>>>>> +RUN apt update && \
>>>>>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu
>>>>>> +
>>>>>> +ARG QEMU_VERSION
>>>>>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}"
>>>>>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"
>>>>>> +
>>>>>> +RUN cd /tmp && \
>>>>>> +mkdir qemu && cd qemu && git init && \
>>>>>> +git remote add origin "${QEMU_REPO}" && \
>>>>>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \
>>>>>> +git checkout FETCH_HEAD && \
>>>>>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \
>>>>>> +make install -j $(nproc) && \
>>>>>> +strip /opt/qemu/bin/* && \
>>>>>
>>>>> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line
>>>>> to make migration-test work from inside the container:
>>>>>
>>>>> migration-test
>>>>> sh
>>>>> env
>>>>> docker (installed as docker.io up there)
>>>>> cat
>>>>>
>>>>
>>>> You mean by mounting current folder in the container?
>>>>
>>>
>>> I mean having the test binary present in the container as well.
>>>
>>> This is something specific to migration compat testing: to avoid having
>>> issues due to features mismatches, we run the older version of
>>> migration-test when testing two different QEMU versions.
>>>
>>> But then...
>>> $ git checkout <old tag>
>>> $ make check-build
>>> $ ./migration-test <QEMU old container> <QEMU new container>
>>>
>>> is kind of wasteful. I can simply build a container with QEMU +
>>> migration-test already in it and invoke:
>>>
>>> $ ./<migration-test old container> <QEMU old container> <QEMU new container>
>>>
>>
>> Ok, I see. I'm not very familiar with migration testing, and assumed the
>> logic was opposite (that migration-test is backward compatible to test
>> from old versions).
>>
> 
> It was the original idea, but we noticed it was way easier to just pin
> the test.
>

I guess there are good reasons for it, but it seems like it would be
much better to work from current HEAD instead of having to checkout and
build an older version of the test.
Flagging sub test per QEMU version does not seem too complex to
implement (min_version=8.0.x, so this test is skipped when running with
an older QEMU).

>> But migration-test is not included in old container, since it's a test
>> binary (thus not installed). I feel that for this case, you need to
>> build from sources, at least to get migration-test-old.
>>
> 
> It's built inside the container along with QEMU. The cp line I added
> brings it over.
>

Got you.

>>>> I'm not against it, but I feel that if we go this way, it's just easier
>>>> to say "let's use the full base image", since it will become "I need to
>>>> run python, and X, and Y, and Z".
>>>>
>>>
>>> I think we should merge this series as is. However if we intend to use
>>> it in the future for something more complex, something like the above
>>> will probably come up. Anyway, I posted literally "for the record".
>>>
>>
>> Sure, I'm just interested to make something useful for you. If it's half
>> baked, there is little value in merging this.
>>
> 
> I don't want to enlarge this container too much. In its current form
> it's also useful to others.
>

Yes, I'll merge it as it is for now.

> For migration, we'd need the extra binaries I mentioned plus the output
> of -dump-vmstate to run ./scripts/vmstate-static-checker.py. It's
> probably better to have a separate container image with those.
>

Regards,
Pierrick

Re: [PATCH v5 1/2] tests/docker/dockerfiles: add release.docker

[Fabiano Rosas]

Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:

> On 10/29/2026 11:35 AM, Fabiano Rosas wrote:
>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>> 
>>> On 10/29/2026 10:39 AM, Fabiano Rosas wrote:
>>>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>>>>
>>>>> On 10/29/2026 6:41 AM, Fabiano Rosas wrote:
>>>>>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>>>>>>
>>>>>>> This new dockerfile allows to build a distroless image containing only
>>>>>>> qemu stripped release binaries, their lib dependencies, and installed
>>>>>>> artifacts (roms, keymap, ...). There is no shell, no python, nothing
>>>>>>> else. This is achieved thanks to a multi-stage build, where we add qemu
>>>>>>> binaries, artifacts and libraries in a new scratch image. Image has
>>>>>>> the minimal size possible.
>>>>>>>
>>>>>>> This is based on Ubuntu, which has the advantage to have working
>>>>>>> containers available down to 14.04. Debian old old stable have broken
>>>>>>> apt sources for instance.
>>>>>>>
>>>>>>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018).
>>>>>>> We could build down to v0.12.0, but it would require more tweaks in the
>>>>>>> dockerfile, so we keep it simple instead.
>>>>>>>
>>>>>>> To build the image, you need to provide a qemu and ubuntu version:
>>>>>>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>>>>>>>
>>>>>>> To run it, as there is no shell, and no defined entrypoint, you need to
>>>>>>> choose the binary you want explicitely:
>>>>>>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
>>>>>>>
>>>>>>> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
>>>>>>> Reviewed-by: Fabiano Rosas <farosas@suse.de>
>>>>>>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
>>>>>>> ---
>>>>>>>  tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++
>>>>>>>  1 file changed, 48 insertions(+)
>>>>>>>  create mode 100644 tests/docker/dockerfiles/release.docker
>>>>>>>
>>>>>>> diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker/dockerfiles/release.docker
>>>>>>> new file mode 100644
>>>>>>> index 00000000000..ca6babde01e
>>>>>>> --- /dev/null
>>>>>>> +++ b/tests/docker/dockerfiles/release.docker
>>>>>>> @@ -0,0 +1,48 @@
>>>>>>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set"
>>>>>>> +
>>>>>>> +FROM ubuntu:$UBUNTU_VERSION AS build
>>>>>>> +
>>>>>>> +# add deb-src for apt build-dep
>>>>>>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* || true
>>>>>>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list
>>>>>>> +# archive.canonical.com is not reachable anymore, and cause a long timeout
>>>>>>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list
>>>>>>> +
>>>>>>> +# build dependencies
>>>>>>> +RUN apt update && \
>>>>>>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex bison
>>>>>>> +RUN apt update && \
>>>>>>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu
>>>>>>> +
>>>>>>> +ARG QEMU_VERSION
>>>>>>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}"
>>>>>>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"
>>>>>>> +
>>>>>>> +RUN cd /tmp && \
>>>>>>> +mkdir qemu && cd qemu && git init && \
>>>>>>> +git remote add origin "${QEMU_REPO}" && \
>>>>>>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \
>>>>>>> +git checkout FETCH_HEAD && \
>>>>>>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \
>>>>>>> +make install -j $(nproc) && \
>>>>>>> +strip /opt/qemu/bin/* && \
>>>>>>
>>>>>> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line
>>>>>> to make migration-test work from inside the container:
>>>>>>
>>>>>> migration-test
>>>>>> sh
>>>>>> env
>>>>>> docker (installed as docker.io up there)
>>>>>> cat
>>>>>>
>>>>>
>>>>> You mean by mounting current folder in the container?
>>>>>
>>>>
>>>> I mean having the test binary present in the container as well.
>>>>
>>>> This is something specific to migration compat testing: to avoid having
>>>> issues due to features mismatches, we run the older version of
>>>> migration-test when testing two different QEMU versions.
>>>>
>>>> But then...
>>>> $ git checkout <old tag>
>>>> $ make check-build
>>>> $ ./migration-test <QEMU old container> <QEMU new container>
>>>>
>>>> is kind of wasteful. I can simply build a container with QEMU +
>>>> migration-test already in it and invoke:
>>>>
>>>> $ ./<migration-test old container> <QEMU old container> <QEMU new container>
>>>>
>>>
>>> Ok, I see. I'm not very familiar with migration testing, and assumed the
>>> logic was opposite (that migration-test is backward compatible to test
>>> from old versions).
>>>
>> 
>> It was the original idea, but we noticed it was way easier to just pin
>> the test.
>>
>
> I guess there are good reasons for it, but it seems like it would be
> much better to work from current HEAD instead of having to checkout and
> build an older version of the test.

There are advantages to using the old tests, maybe the main one is that
we never need to think about older versions when writing the tests.
What was there at the time is what's supported and that's it. If an old
test breaks with a new QEMU, then the users will probably see the exact
same breakage.

> Flagging sub test per QEMU version does not seem too complex to
> implement (min_version=8.0.x, so this test is skipped when running with
> an older QEMU).
>

These are big integration tests that all run the entire migration
process from end to end. If they were smaller unit tests, then it would
be indeed simpler. But I confess we didn't try too hard.

>>> But migration-test is not included in old container, since it's a test
>>> binary (thus not installed). I feel that for this case, you need to
>>> build from sources, at least to get migration-test-old.
>>>
>> 
>> It's built inside the container along with QEMU. The cp line I added
>> brings it over.
>>
>
> Got you.
>
>>>>> I'm not against it, but I feel that if we go this way, it's just easier
>>>>> to say "let's use the full base image", since it will become "I need to
>>>>> run python, and X, and Y, and Z".
>>>>>
>>>>
>>>> I think we should merge this series as is. However if we intend to use
>>>> it in the future for something more complex, something like the above
>>>> will probably come up. Anyway, I posted literally "for the record".
>>>>
>>>
>>> Sure, I'm just interested to make something useful for you. If it's half
>>> baked, there is little value in merging this.
>>>
>> 
>> I don't want to enlarge this container too much. In its current form
>> it's also useful to others.
>>
>
> Yes, I'll merge it as it is for now.
>

Yep, thanks again!

>> For migration, we'd need the extra binaries I mentioned plus the output
>> of -dump-vmstate to run ./scripts/vmstate-static-checker.py. It's
>> probably better to have a separate container image with those.
>>
>
> Regards,
> Pierrick

Re: [PATCH v5 1/2] tests/docker/dockerfiles: add release.docker

[Pierrick Bouvier]

On 10/29/2026 12:10 PM, Fabiano Rosas wrote:
> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
> 
>> On 10/29/2026 11:35 AM, Fabiano Rosas wrote:
>>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>>>
>>>> On 10/29/2026 10:39 AM, Fabiano Rosas wrote:
>>>>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>>>>>
>>>>>> On 10/29/2026 6:41 AM, Fabiano Rosas wrote:
>>>>>>> Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com> writes:
>>>>>>>
>>>>>>>> This new dockerfile allows to build a distroless image containing only
>>>>>>>> qemu stripped release binaries, their lib dependencies, and installed
>>>>>>>> artifacts (roms, keymap, ...). There is no shell, no python, nothing
>>>>>>>> else. This is achieved thanks to a multi-stage build, where we add qemu
>>>>>>>> binaries, artifacts and libraries in a new scratch image. Image has
>>>>>>>> the minimal size possible.
>>>>>>>>
>>>>>>>> This is based on Ubuntu, which has the advantage to have working
>>>>>>>> containers available down to 14.04. Debian old old stable have broken
>>>>>>>> apt sources for instance.
>>>>>>>>
>>>>>>>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018).
>>>>>>>> We could build down to v0.12.0, but it would require more tweaks in the
>>>>>>>> dockerfile, so we keep it simple instead.
>>>>>>>>
>>>>>>>> To build the image, you need to provide a qemu and ubuntu version:
>>>>>>>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0
>>>>>>>>
>>>>>>>> To run it, as there is no shell, and no defined entrypoint, you need to
>>>>>>>> choose the binary you want explicitely:
>>>>>>>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
>>>>>>>>
>>>>>>>> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
>>>>>>>> Reviewed-by: Fabiano Rosas <farosas@suse.de>
>>>>>>>> Signed-off-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
>>>>>>>> ---
>>>>>>>>  tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++
>>>>>>>>  1 file changed, 48 insertions(+)
>>>>>>>>  create mode 100644 tests/docker/dockerfiles/release.docker
>>>>>>>>
>>>>>>>> diff --git a/tests/docker/dockerfiles/release.docker b/tests/docker/dockerfiles/release.docker
>>>>>>>> new file mode 100644
>>>>>>>> index 00000000000..ca6babde01e
>>>>>>>> --- /dev/null
>>>>>>>> +++ b/tests/docker/dockerfiles/release.docker
>>>>>>>> @@ -0,0 +1,48 @@
>>>>>>>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set"
>>>>>>>> +
>>>>>>>> +FROM ubuntu:$UBUNTU_VERSION AS build
>>>>>>>> +
>>>>>>>> +# add deb-src for apt build-dep
>>>>>>>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* || true
>>>>>>>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list
>>>>>>>> +# archive.canonical.com is not reachable anymore, and cause a long timeout
>>>>>>>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list
>>>>>>>> +
>>>>>>>> +# build dependencies
>>>>>>>> +RUN apt update && \
>>>>>>>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex bison
>>>>>>>> +RUN apt update && \
>>>>>>>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu
>>>>>>>> +
>>>>>>>> +ARG QEMU_VERSION
>>>>>>>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}"
>>>>>>>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"
>>>>>>>> +
>>>>>>>> +RUN cd /tmp && \
>>>>>>>> +mkdir qemu && cd qemu && git init && \
>>>>>>>> +git remote add origin "${QEMU_REPO}" && \
>>>>>>>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \
>>>>>>>> +git checkout FETCH_HEAD && \
>>>>>>>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \
>>>>>>>> +make install -j $(nproc) && \
>>>>>>>> +strip /opt/qemu/bin/* && \
>>>>>>>
>>>>>>> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line
>>>>>>> to make migration-test work from inside the container:
>>>>>>>
>>>>>>> migration-test
>>>>>>> sh
>>>>>>> env
>>>>>>> docker (installed as docker.io up there)
>>>>>>> cat
>>>>>>>
>>>>>>
>>>>>> You mean by mounting current folder in the container?
>>>>>>
>>>>>
>>>>> I mean having the test binary present in the container as well.
>>>>>
>>>>> This is something specific to migration compat testing: to avoid having
>>>>> issues due to features mismatches, we run the older version of
>>>>> migration-test when testing two different QEMU versions.
>>>>>
>>>>> But then...
>>>>> $ git checkout <old tag>
>>>>> $ make check-build
>>>>> $ ./migration-test <QEMU old container> <QEMU new container>
>>>>>
>>>>> is kind of wasteful. I can simply build a container with QEMU +
>>>>> migration-test already in it and invoke:
>>>>>
>>>>> $ ./<migration-test old container> <QEMU old container> <QEMU new container>
>>>>>
>>>>
>>>> Ok, I see. I'm not very familiar with migration testing, and assumed the
>>>> logic was opposite (that migration-test is backward compatible to test
>>>> from old versions).
>>>>
>>>
>>> It was the original idea, but we noticed it was way easier to just pin
>>> the test.
>>>
>>
>> I guess there are good reasons for it, but it seems like it would be
>> much better to work from current HEAD instead of having to checkout and
>> build an older version of the test.
> 
> There are advantages to using the old tests, maybe the main one is that
> we never need to think about older versions when writing the tests.
> What was there at the time is what's supported and that's it. If an old
> test breaks with a new QEMU, then the users will probably see the exact
> same breakage.
> 
>> Flagging sub test per QEMU version does not seem too complex to
>> implement (min_version=8.0.x, so this test is skipped when running with
>> an older QEMU).
>>
> 
> These are big integration tests that all run the entire migration
> process from end to end. If they were smaller unit tests, then it would
> be indeed simpler. But I confess we didn't try too hard.
> 
>>>> But migration-test is not included in old container, since it's a test
>>>> binary (thus not installed). I feel that for this case, you need to
>>>> build from sources, at least to get migration-test-old.
>>>>
>>>
>>> It's built inside the container along with QEMU. The cp line I added
>>> brings it over.
>>>
>>
>> Got you.
>>
>>>>>> I'm not against it, but I feel that if we go this way, it's just easier
>>>>>> to say "let's use the full base image", since it will become "I need to
>>>>>> run python, and X, and Y, and Z".
>>>>>>
>>>>>
>>>>> I think we should merge this series as is. However if we intend to use
>>>>> it in the future for something more complex, something like the above
>>>>> will probably come up. Anyway, I posted literally "for the record".
>>>>>
>>>>
>>>> Sure, I'm just interested to make something useful for you. If it's half
>>>> baked, there is little value in merging this.
>>>>
>>>
>>> I don't want to enlarge this container too much. In its current form
>>> it's also useful to others.
>>>
>>
>> Yes, I'll merge it as it is for now.
>>
> 
> Yep, thanks again!
>

Feel free to send a patch in the future to add deps and extra binaries
with an associated --build-arg INCLUDE_TEST_BINARIES.

As long as it's not the default behavior, there is no problem to include it.

Regards,
Pierrick