Re: [PULL 6/6] configure: --disable-containers should prevent `docker.py probe`

["Daniel P. Berrangé" <berrange@redhat.com>]

On Thu, Nov 12, 2026 at 09:45:09PM +0300, Michael Tokarev wrote:
> From: Matthew White <mehw.is.me@proton.me>
> 
> Upstream commit c4ce04cfb7460d46c0262d437a7f35bb5c5fc449 changed the
> configure file to set container_command regardless of use_containers.
> As a result, it runs `docker.py probe` to detect a Docker-compatible
> application, such as Podman, even when --disable-containers is used.
> 
> On Gentoo, this reopens https://bugs.gentoo.org/732972.  As reported
> in https://bugs.gentoo.org/984747, the `docker.py probe` command can
> trigger SANDBOX ACCESS VIOLATION errors under QEMU v11.1.2:
> 
>  * ACCESS DENIED:  open_wr_creat: /var/lib/rpm/rpmdb.sqlite-wal
>  * ACCESS DENIED:  fchown:        /var/lib/rpm/rpmdb.sqlite-wal
>  ...

I'm puzzled why docker.py probe would touch the RPM database.

As long as the configure script does not break though, having
the system log sandbox warnings is not a bug from QEMU's POV
IMHO.

The probe can be disabled by using --container-command=podman
or probably even --container-command=false would work.

> This patch is to prevent `docker.py probe` from running and to clear
> container_command when --disable-containers is used.

This reintroduces the problem that c4ce04cfb7460d46c0262d437a7f35bb5c5fc449
was fixing, because tests/docker/Makefile will now re-run the docker
probe on every command.

The --disable-containers arg was only intended to disable the use of
cross compilation in containers for the purposes of TCG testsuite.

> 
> Buglink: https://bugs.gentoo.org/984747
> Signed-off-by: Matthew White <mehw.is.me@proton.me>
> Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
> ---
>  configure | 17 +++++++++++------
>  1 file changed, 11 insertions(+), 6 deletions(-)
> 
> diff --git a/configure b/configure
> index af14a9c23ef..d38268e340f 100755
> --- a/configure
> +++ b/configure
> @@ -1277,12 +1277,17 @@ fi
>  ##########################################
>  # functions to probe cross compilers
>  
> -if test "$container_command" = ""; then
> -    container_command=$($python "$source_path"/tests/docker/docker.py probe)
> -    test "$container_command" = "no" && container_command=""
> -fi
> -if test $use_containers = "yes" && test "$container_command" != ""; then
> -    docker_py="$python $source_path/tests/docker/docker.py --command $container_command"
> +if test $use_containers = "yes"; then
> +    if test "$container_command" = ""; then
> +        container_command=$($python "$source_path"/tests/docker/docker.py probe)
> +        test "$container_command" = "no" && container_command=""
> +    fi
> +    if test "$container_command" != ""; then
> +        docker_py="$python $source_path/tests/docker/docker.py --command $container_command"
> +    fi
> +else
> +    # the option --disable-containers should override and disable --container-command
> +    container_command=""
>  fi
>  
>  # cross compilers defaults, can be overridden with --cross-cc-ARCH
> -- 
> 2.47.3
> 
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|