* [Buildroot] [PATCH 0/8] package/podman: new package (branch yem/podman)
@ 2025-02-23 21:14 Yann E. MORIN
2025-02-23 21:14 ` [Buildroot] [PATCH 1/8] support/testing: set date in emulated machine Yann E. MORIN
` (7 more replies)
0 siblings, 8 replies; 13+ messages in thread
From: Yann E. MORIN @ 2025-02-23 21:14 UTC (permalink / raw)
To: buildroot
Cc: Christian Stewart, Fiona Klute, Raphael Pavlidis,
Ricardo Martincoski, Thomas Petazzoni, Yann E . MORIN,
Yann E . MORIN
Hello All!
This series introduce podman, an alternative to Docker. Podman is
daemon-less, and does not need root either.
The series starts with preparatory commits in existing packages and the
testing infra: then it introduces new packages on which podman will
rely.
Not required by podman, skopeo is made a target package as well, as it
was of help debugging podman (and Docker in a separate series).
Regards,
Yann E. MORIN.
----------------------------------------------------------------
Yann E. MORIN (8):
support/testing: set date in emulated machine
package/shadow: install to staging for subids
package/conmon: depends on systemd when enabled
package/skopeo: add target variant
package/cgroupfs-mount: tweak the kernel config
package/cgroupfs-v2-mount: new package
package/netavark: new package
package/podman: new package
package/Config.in | 4 +
package/cgroupfs-mount/Config.in | 12 +--
package/cgroupfs-mount/cgroupfs-mount.mk | 11 +++
package/cgroupfs-v2-mount/Config.in | 10 ++
package/cgroupfs-v2-mount/S30cgroupfs2 | 43 +++++++++
package/cgroupfs-v2-mount/cgroupfs-v2-mount.mk | 16 ++++
package/conmon/conmon.mk | 4 +
package/netavark/Config.in | 10 ++
package/netavark/netavark.hash | 2 +
package/netavark/netavark.mk | 16 ++++
package/podman/Config.in | 38 ++++++++
package/podman/podman.hash | 2 +
package/podman/podman.mk | 109 ++++++++++++++++++++++
package/podman/policy.json | 7 ++
package/podman/registries.conf | 1 +
package/shadow/shadow.mk | 1 +
package/skopeo/Config.in | 25 +++++
package/skopeo/skopeo.mk | 10 ++
support/testing/infra/emulator.py | 3 +
support/testing/tests/package/test_podman.py | 124 +++++++++++++++++++++++++
support/testing/tests/package/test_skopeo.py | 41 ++++++++
21 files changed, 478 insertions(+), 11 deletions(-)
create mode 100644 package/cgroupfs-v2-mount/Config.in
create mode 100644 package/cgroupfs-v2-mount/S30cgroupfs2
create mode 100644 package/cgroupfs-v2-mount/cgroupfs-v2-mount.mk
create mode 100644 package/netavark/Config.in
create mode 100644 package/netavark/netavark.hash
create mode 100644 package/netavark/netavark.mk
create mode 100644 package/podman/Config.in
create mode 100644 package/podman/podman.hash
create mode 100644 package/podman/podman.mk
create mode 100644 package/podman/policy.json
create mode 100644 package/podman/registries.conf
create mode 100644 package/skopeo/Config.in
create mode 100644 support/testing/tests/package/test_podman.py
create mode 100644 support/testing/tests/package/test_skopeo.py
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 13+ messages in thread* [Buildroot] [PATCH 1/8] support/testing: set date in emulated machine 2025-02-23 21:14 [Buildroot] [PATCH 0/8] package/podman: new package (branch yem/podman) Yann E. MORIN @ 2025-02-23 21:14 ` Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 2/8] package/shadow: install to staging for subids Yann E. MORIN ` (6 subsequent siblings) 7 siblings, 0 replies; 13+ messages in thread From: Yann E. MORIN @ 2025-02-23 21:14 UTC (permalink / raw) To: buildroot; +Cc: Yann E. MORIN, Ricardo Martincoski, Thomas Petazzoni When time comes to check certificates, the date and time in the emulated machine should be close enough to the actual values, so that certificate validity can be checked. Set the date to the date of the system. This is going to be accurate to the second, which is, by far, enough for our purpose. Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Cc: Ricardo Martincoski <ricardo.martincoski@datacom.com.br> Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com> --- support/testing/infra/emulator.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/support/testing/infra/emulator.py b/support/testing/infra/emulator.py index ef5be2a19e..1e7f6ce4e8 100644 --- a/support/testing/infra/emulator.py +++ b/support/testing/infra/emulator.py @@ -5,6 +5,7 @@ import os import pexpect import pexpect.replwrap +import time import infra @@ -152,6 +153,8 @@ class Emulator(object): self.connect_shell() + self.run(f"date @{int(time.time())}") + def connect_shell(self): extra_init_cmd = " && ".join([ 'export PAGER=cat', -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 13+ messages in thread
* [Buildroot] [PATCH 2/8] package/shadow: install to staging for subids 2025-02-23 21:14 [Buildroot] [PATCH 0/8] package/podman: new package (branch yem/podman) Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 1/8] support/testing: set date in emulated machine Yann E. MORIN @ 2025-02-23 21:14 ` Yann E. MORIN 2025-02-25 13:46 ` Raphael Pavlidis 2025-02-23 21:14 ` [Buildroot] [PATCH 3/8] package/conmon: depends on systemd when enabled Yann E. MORIN ` (5 subsequent siblings) 7 siblings, 1 reply; 13+ messages in thread From: Yann E. MORIN @ 2025-02-23 21:14 UTC (permalink / raw) To: buildroot; +Cc: Yann E. MORIN, Raphael Pavlidis When the subids feature is enabled, shadow will install a library and a header: $ sort output/build/shadow-4.16.0/.files-list.txt [...] shadow,./lib/libsubid.la shadow,./lib/libsubid.so shadow,./lib/libsubid.so.5 shadow,./lib/libsubid.so.5.0.0 [...] shadow,./usr/include/shadow/subid.h [...] Install to staging in that case. Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com> --- package/shadow/shadow.mk | 1 + 1 file changed, 1 insertion(+) diff --git a/package/shadow/shadow.mk b/package/shadow/shadow.mk index f0a2b57b4d..2937a9601e 100644 --- a/package/shadow/shadow.mk +++ b/package/shadow/shadow.mk @@ -46,6 +46,7 @@ SHADOW_CONF_OPTS += --disable-account-tools-setuid endif ifeq ($(BR2_PACKAGE_SHADOW_SUBORDINATE_IDS),y) +SHADOW_INSTALL_STAGING = YES SHADOW_CONF_OPTS += --enable-subordinate-ids define SHADOW_SUBORDINATE_IDS_PERMISSIONS /usr/bin/newuidmap f 4755 0 0 - - - - - -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [Buildroot] [PATCH 2/8] package/shadow: install to staging for subids 2025-02-23 21:14 ` [Buildroot] [PATCH 2/8] package/shadow: install to staging for subids Yann E. MORIN @ 2025-02-25 13:46 ` Raphael Pavlidis 0 siblings, 0 replies; 13+ messages in thread From: Raphael Pavlidis @ 2025-02-25 13:46 UTC (permalink / raw) To: Yann E. MORIN, buildroot Hello Yann, the changes looks good. Regards, Raphael Pavlidis On 2/23/25 22:14, Yann E. MORIN wrote: > When the subids feature is enabled, shadow will install a library and a > header: > > $ sort output/build/shadow-4.16.0/.files-list.txt > [...] > shadow,./lib/libsubid.la > shadow,./lib/libsubid.so > shadow,./lib/libsubid.so.5 > shadow,./lib/libsubid.so.5.0.0 > [...] > shadow,./usr/include/shadow/subid.h > [...] > > Install to staging in that case. > > Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> > Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com> > --- > package/shadow/shadow.mk | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/package/shadow/shadow.mk b/package/shadow/shadow.mk > index f0a2b57b4d..2937a9601e 100644 > --- a/package/shadow/shadow.mk > +++ b/package/shadow/shadow.mk > @@ -46,6 +46,7 @@ SHADOW_CONF_OPTS += --disable-account-tools-setuid > endif > > ifeq ($(BR2_PACKAGE_SHADOW_SUBORDINATE_IDS),y) > +SHADOW_INSTALL_STAGING = YES > SHADOW_CONF_OPTS += --enable-subordinate-ids > define SHADOW_SUBORDINATE_IDS_PERMISSIONS > /usr/bin/newuidmap f 4755 0 0 - - - - - _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 13+ messages in thread
* [Buildroot] [PATCH 3/8] package/conmon: depends on systemd when enabled 2025-02-23 21:14 [Buildroot] [PATCH 0/8] package/podman: new package (branch yem/podman) Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 1/8] support/testing: set date in emulated machine Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 2/8] package/shadow: install to staging for subids Yann E. MORIN @ 2025-02-23 21:14 ` Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 4/8] package/skopeo: add target variant Yann E. MORIN ` (4 subsequent siblings) 7 siblings, 0 replies; 13+ messages in thread From: Yann E. MORIN @ 2025-02-23 21:14 UTC (permalink / raw) To: buildroot; +Cc: Yann E. MORIN, Christian Stewart When it detects it runs under systemd, conmon will want to log to the journal. However, it needs to be linked with libsystemd to do so and if it is not, will error out: Feb 22 11:10:03 buildroot conmon[199]: conmon 3b462ce6f2cc64f75c42 <error>: Include journald in compilation path to log to systemd journal This prevents starting any container. Add a dependency to systemd when it is enabled. Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Cc: Christian Stewart <christian@aperture.us> --- package/conmon/conmon.mk | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package/conmon/conmon.mk b/package/conmon/conmon.mk index 1e57786686..ed1a2554fa 100644 --- a/package/conmon/conmon.mk +++ b/package/conmon/conmon.mk @@ -18,6 +18,10 @@ else CONMON_DISABLE_SECCOMP = 1 endif +ifeq ($(BR2_PACKAGE_SYSTEMD),y) +CONMON_DEPENDENCIES += systemd +endif + define CONMON_CONFIGURE_CMDS printf '#!/bin/bash\necho "$(CONMON_DISABLE_SECCOMP)"\n' > \ $(@D)/hack/seccomp-notify.sh -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 13+ messages in thread
* [Buildroot] [PATCH 4/8] package/skopeo: add target variant 2025-02-23 21:14 [Buildroot] [PATCH 0/8] package/podman: new package (branch yem/podman) Yann E. MORIN ` (2 preceding siblings ...) 2025-02-23 21:14 ` [Buildroot] [PATCH 3/8] package/conmon: depends on systemd when enabled Yann E. MORIN @ 2025-02-23 21:14 ` Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 5/8] package/cgroupfs-mount: tweak the kernel config Yann E. MORIN ` (3 subsequent siblings) 7 siblings, 0 replies; 13+ messages in thread From: Yann E. MORIN @ 2025-02-23 21:14 UTC (permalink / raw) To: buildroot; +Cc: Yann E. MORIN, Christian Stewart, Yann E. MORIN Skopeo can be used to manipulate container images, and so can be usefull on target devices that are going to be used as a host to run containers. So, add a target variant for skopeo. ... with a runtime test while at it. Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Cc: Christian Stewart <christian@aperture.us> Cc: Yann E. MORIN <yann.morin@orange.com> --- package/Config.in | 1 + package/skopeo/Config.in | 25 ++++++++++++ package/skopeo/skopeo.mk | 10 +++++ support/testing/tests/package/test_skopeo.py | 41 ++++++++++++++++++++ 4 files changed, 77 insertions(+) create mode 100644 package/skopeo/Config.in create mode 100644 support/testing/tests/package/test_skopeo.py diff --git a/package/Config.in b/package/Config.in index bd3a00abc3..da21d45a98 100644 --- a/package/Config.in +++ b/package/Config.in @@ -2891,6 +2891,7 @@ menu "System tools" source "package/sdbusplus/Config.in" source "package/seatd/Config.in" source "package/shadow/Config.in" + source "package/skopeo/Config.in" source "package/smack/Config.in" source "package/start-stop-daemon/Config.in" source "package/supervisor/Config.in" diff --git a/package/skopeo/Config.in b/package/skopeo/Config.in new file mode 100644 index 0000000000..f1acc3a50f --- /dev/null +++ b/package/skopeo/Config.in @@ -0,0 +1,25 @@ +config BR2_PACKAGE_SKOPEO + bool "skopeo" + depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS + depends on BR2_USE_MMU # btrfs-progs, libgpgme, lvm2 + depends on BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS # libgpgme + depends on BR2_TOOLCHAIN_HAS_THREADS # btrfs-progs, lvm2 + depends on !BR2_STATIC_LIBS # lvm2 + select BR2_PACKAGE_HOST_GO + select BR2_PACKAGE_BTRFS_PROGS + select BR2_PACKAGE_LIBGPGME + select BR2_PACKAGE_LVM2 + help + skopeo is a command line utility that performs various + operations on container images and image repositories. + + https://github.com/containers/skopeo + +comment "skopeo needs a toolchain w/ threads, sahred libs" + depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS + depends on BR2_USE_MMU + depends on BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS + depends on !BR2_TOOLCHAIN_HAS_THREADS \ + || BR2_STATIC_LIBS diff --git a/package/skopeo/skopeo.mk b/package/skopeo/skopeo.mk index 8e3a302e8d..b3b213983f 100644 --- a/package/skopeo/skopeo.mk +++ b/package/skopeo/skopeo.mk @@ -11,13 +11,23 @@ SKOPEO_LICENSE = Apache-2.0 SKOPEO_LICENSE_FILES = LICENSE SKOPEO_CPE_ID_VALID = YES +SKOPEO_DEPENDENCIES = \ + host-pkgconf \ + btrfs-progs \ + libgpgme \ + lvm2 + HOST_SKOPEO_DEPENDENCIES = \ host-btrfs-progs \ host-libgpgme \ host-lvm2 \ host-pkgconf +SKOPEO_GO_ENV = PKG_CONFIG_PATH=$(HOST_DIR)/lib/pkgconfig +SKOPEO_BUILD_TARGETS = cmd/skopeo + HOST_SKOPEO_GO_ENV = PKG_CONFIG_PATH=$(HOST_DIR)/lib/pkgconfig HOST_SKOPEO_BUILD_TARGETS = cmd/skopeo +$(eval $(golang-package)) $(eval $(host-golang-package)) diff --git a/support/testing/tests/package/test_skopeo.py b/support/testing/tests/package/test_skopeo.py new file mode 100644 index 0000000000..79c3da8b3d --- /dev/null +++ b/support/testing/tests/package/test_skopeo.py @@ -0,0 +1,41 @@ +import infra.basetest +import json +import os + + +class TestSkopeo(infra.basetest.BRTest): + config = infra.basetest.BASIC_TOOLCHAIN_CONFIG + \ + """ + BR2_PER_PACKAGE_DIRECTORIES=y + BR2_SYSTEM_DHCP="eth0" + BR2_PACKAGE_CA_CERTIFICATES=y + BR2_PACKAGE_SKOPEO=y + BR2_PACKAGE_HOST_GO_BIN=y + BR2_TARGET_ROOTFS_CPIO=y + # BR2_TARGET_ROOTFS_TAR is not set + """ + + def test_run(self): + cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio") + self.emulator.boot(arch="armv5", + kernel="builtin", + options=["-initrd", cpio_file, "-nic", "user,model=rtl8139"]) + self.emulator.login() + + self.assertRunOk("skopeo --version", timeout=30) + + # First, check we can reach the default registry: docker.io + output, _ = self.emulator.run( + "skopeo inspect docker://busybox:latest", + timeout=60, + ) + bb_info = json.loads("".join(output)) + self.assertEqual(bb_info["Name"], "docker.io/library/busybox") + + # Now, check we can reach an arbitrary registry: quay.io + output, _ = self.emulator.run( + "skopeo inspect docker://quay.io/quay/busybox:latest", + timeout=60, + ) + skopeo_info = json.loads("".join(output)) + self.assertEqual(skopeo_info["Name"], "quay.io/quay/busybox") -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 13+ messages in thread
* [Buildroot] [PATCH 5/8] package/cgroupfs-mount: tweak the kernel config 2025-02-23 21:14 [Buildroot] [PATCH 0/8] package/podman: new package (branch yem/podman) Yann E. MORIN ` (3 preceding siblings ...) 2025-02-23 21:14 ` [Buildroot] [PATCH 4/8] package/skopeo: add target variant Yann E. MORIN @ 2025-02-23 21:14 ` Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 6/8] package/cgroupfs-v2-mount: new package Yann E. MORIN ` (2 subsequent siblings) 7 siblings, 0 replies; 13+ messages in thread From: Yann E. MORIN @ 2025-02-23 21:14 UTC (permalink / raw) To: buildroot; +Cc: Yann E. MORIN When it was introduced in 2016 with commit 0e1547a87cfd (cgroupfs-mount: new package), we did not yet have the infrastrucutre for package to set kernel config options, which only came 4 years later with commit 0aed4c2dae76 (linux: allow packages to set kernel config options). So at that time, the requirements for cgroupfs-mount were documented in the help for the Kconfig symbol. But now that we do have tha infrastructure in place, actually use it to set the required options, and drop the list from the Lconfig entry (that would be duplication, prone to bit-rot with time, and other packages do not document their requirements in LKconfig, they just use the infra to set the options). Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> --- package/cgroupfs-mount/Config.in | 12 +----------- package/cgroupfs-mount/cgroupfs-mount.mk | 11 +++++++++++ 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/package/cgroupfs-mount/Config.in b/package/cgroupfs-mount/Config.in index 0b2e4ba1e7..29a40c93d1 100644 --- a/package/cgroupfs-mount/Config.in +++ b/package/cgroupfs-mount/Config.in @@ -4,16 +4,6 @@ config BR2_PACKAGE_CGROUPFS_MOUNT help cgroupfs mount and umount scripts. - requires a Linux kernel >= 3.0 with the following options - enabled: - - - CONFIG_BLK_CGROUP - - CONFIG_CGROUPS - - CONFIG_CGROUP_CPUACCT - - CONFIG_CGROUP_DEVICE - - CONFIG_CGROUP_FREEZER - - CONFIG_CGROUP_WRITEBACK - - CONFIG_CGROUP_SCHED - - CONFIG_CGROUP_PIDS + Requires a Linux kernel >= 3.0 https://github.com/tianon/cgroupfs-mount diff --git a/package/cgroupfs-mount/cgroupfs-mount.mk b/package/cgroupfs-mount/cgroupfs-mount.mk index 5af87629ea..156d584266 100644 --- a/package/cgroupfs-mount/cgroupfs-mount.mk +++ b/package/cgroupfs-mount/cgroupfs-mount.mk @@ -10,6 +10,17 @@ CGROUPFS_MOUNT_LICENSE = GPL-3.0+ CGROUPFS_MOUNT_LICENSE_FILES = debian/copyright CGROUPFS_MOUNT_CPE_ID_VALID = YES +define CGROUPFS_MOUNT_LINUX_CONFIG_FIXUPS + $(call KCONFIG_ENABLE_OPT,CONFIG_BLK_CGROUP) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUPS) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_CPUACCT) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_DEVICE) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_FREEZER) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_WRITEBACK) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_SCHED) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_PIDS) +endef + define CGROUPFS_MOUNT_INSTALL_TARGET_CMDS $(INSTALL) -D -m 0755 $(@D)/cgroupfs-mount $(TARGET_DIR)/usr/bin/cgroupfs-mount $(INSTALL) -D -m 0755 $(@D)/cgroupfs-umount $(TARGET_DIR)/usr/bin/cgroupfs-umount -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 13+ messages in thread
* [Buildroot] [PATCH 6/8] package/cgroupfs-v2-mount: new package 2025-02-23 21:14 [Buildroot] [PATCH 0/8] package/podman: new package (branch yem/podman) Yann E. MORIN ` (4 preceding siblings ...) 2025-02-23 21:14 ` [Buildroot] [PATCH 5/8] package/cgroupfs-mount: tweak the kernel config Yann E. MORIN @ 2025-02-23 21:14 ` Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 7/8] package/netavark: " Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 8/8] package/podman: " Yann E. MORIN 7 siblings, 0 replies; 13+ messages in thread From: Yann E. MORIN @ 2025-02-23 21:14 UTC (permalink / raw) To: buildroot; +Cc: Yann E. MORIN, Fiona Klute, Thomas Petazzoni Currently, the cgroupfs-mount package only mounts a cgroup v1 hierarchy, but v1 is considered legacy and obsolete, while v2 has ben around for a while now, and is required by some packages (e.g. podman whines about v1). cgroupfs-mount has not had a release in almost 8 years now, and only the occasional commit since then and until more than 3 years ago. It's not going to evolve... Add a new package with a simple-enough sysv startup script, that mounts the cgroup v2 hierarchy filesystem. For systemd, there's nothing to do, as systemd handles the mount by itself. Since both cgroup v1 and v2 use the same mountpoint, we can't have both enabled at the same time, and thus we restrict the v2 to be hidden when v1 is enabled (quite a few packages select the v1; changing those would require that they be validated against v2 first...) Note that, due to limitations in Kconfig, cgroupfs-v2-mount will appear indented below cgroupfs-mount, because it has a (negative) dependnecy on it. This spurious indentation is unfortunate and annoying, but benign; fixing that would require breaking the dependency with a random Kconfig symbole, which we dont have, and which we decided not to introduce jsut for this one use-case (well, there's host-gnupg and host-gnupg2 that have the exact same issue, but meh...) Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Cc: Fiona Klute <fiona.klute@gmx.de> Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com> --- package/Config.in | 1 + package/cgroupfs-v2-mount/Config.in | 10 +++++ package/cgroupfs-v2-mount/S30cgroupfs2 | 43 +++++++++++++++++++ .../cgroupfs-v2-mount/cgroupfs-v2-mount.mk | 16 +++++++ 4 files changed, 70 insertions(+) create mode 100644 package/cgroupfs-v2-mount/Config.in create mode 100644 package/cgroupfs-v2-mount/S30cgroupfs2 create mode 100644 package/cgroupfs-v2-mount/cgroupfs-v2-mount.mk diff --git a/package/Config.in b/package/Config.in index da21d45a98..5a3af06571 100644 --- a/package/Config.in +++ b/package/Config.in @@ -2807,6 +2807,7 @@ menu "System tools" source "package/balena-engine/Config.in" source "package/bubblewrap/Config.in" source "package/cgroupfs-mount/Config.in" + source "package/cgroupfs-v2-mount/Config.in" source "package/circus/Config.in" source "package/conmon/Config.in" source "package/containerd/Config.in" diff --git a/package/cgroupfs-v2-mount/Config.in b/package/cgroupfs-v2-mount/Config.in new file mode 100644 index 0000000000..2dd2dbc089 --- /dev/null +++ b/package/cgroupfs-v2-mount/Config.in @@ -0,0 +1,10 @@ +config BR2_PACKAGE_CGROUPFS_V2_MOUNT + bool "cgroupfs-v2-mount" + depends on !BR2_INIT_SYSTEMD + depends on !BR2_PACKAGE_CGROUPFS_MOUNT + help + Mount the cgroup v2 hierarchy filesystem. + +comment "cgroupfs-v2-mount is incompatible with cgroupfs-mount" + depends on !BR2_INIT_SYSTEMD + depends on BR2_PACKAGE_CGROUPFS_MOUNT diff --git a/package/cgroupfs-v2-mount/S30cgroupfs2 b/package/cgroupfs-v2-mount/S30cgroupfs2 new file mode 100644 index 0000000000..7f80d1c405 --- /dev/null +++ b/package/cgroupfs-v2-mount/S30cgroupfs2 @@ -0,0 +1,43 @@ +#!/bin/sh + +DAEMON=cgroupfs2 + +start() { + printf 'Mounting %s: ' "${DAEMON}" + mount -t cgroup2 none /sys/fs/cgroup + status=$? + if [ "$status" -eq 0 ]; then + echo "OK" + else + echo "FAIL" + fi + return "$status" +} + +stop() { + printf 'Unmounting %s: ' "${DAEMON}" + mount -t cgroup2 none /sys/fs/cgroup + status=$? + if [ "$status" -eq 0 ]; then + echo "OK" + else + echo "FAIL" + fi + return "$status" +} + +restart() { + stop + start +} + +case "$1" in + start|stop|restart) + "$1";; + reload) + # Restart, since there is no true "reload" feature. + restart;; + *) + echo "Usage: $0 {start|stop|restart|reload}" + exit 1 +esac diff --git a/package/cgroupfs-v2-mount/cgroupfs-v2-mount.mk b/package/cgroupfs-v2-mount/cgroupfs-v2-mount.mk new file mode 100644 index 0000000000..66db3b3ffa --- /dev/null +++ b/package/cgroupfs-v2-mount/cgroupfs-v2-mount.mk @@ -0,0 +1,16 @@ +################################################################################ +# +# cgroupfs-v2-mount +# +################################################################################ + +CGROUPFS_V2_MOUNT_VERSION = +CGROUPFS_V2_MOUNT_SITE = + +define CGROUPFS_V2_MOUNT_INSTALL_INIT_SYSV + $(INSTALL) -m 0755 -D \ + $(CGROUPFS_V2_MOUNT_PKGDIR)/S30cgroupfs2 \ + $(TARGET_DIR)/etc/init.d/S30cgroupfs2 +endef + +$(eval $(generic-package)) -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 13+ messages in thread
* [Buildroot] [PATCH 7/8] package/netavark: new package 2025-02-23 21:14 [Buildroot] [PATCH 0/8] package/podman: new package (branch yem/podman) Yann E. MORIN ` (5 preceding siblings ...) 2025-02-23 21:14 ` [Buildroot] [PATCH 6/8] package/cgroupfs-v2-mount: new package Yann E. MORIN @ 2025-02-23 21:14 ` Yann E. MORIN 2025-02-23 22:58 ` Julien Olivain 2025-02-23 21:14 ` [Buildroot] [PATCH 8/8] package/podman: " Yann E. MORIN 7 siblings, 1 reply; 13+ messages in thread From: Yann E. MORIN @ 2025-02-23 21:14 UTC (permalink / raw) To: buildroot; +Cc: Yann E. MORIN Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> --- package/Config.in | 1 + package/netavark/Config.in | 10 ++++++++++ package/netavark/netavark.hash | 2 ++ package/netavark/netavark.mk | 16 ++++++++++++++++ 4 files changed, 29 insertions(+) create mode 100644 package/netavark/Config.in create mode 100644 package/netavark/netavark.hash create mode 100644 package/netavark/netavark.mk diff --git a/package/Config.in b/package/Config.in index 5a3af06571..6e38f0ef33 100644 --- a/package/Config.in +++ b/package/Config.in @@ -2559,6 +2559,7 @@ endif source "package/ndisc6/Config.in" source "package/net-tools/Config.in" source "package/netatalk/Config.in" + source "package/netavark/Config.in" source "package/netcalc/Config.in" source "package/netcat/Config.in" source "package/netcat-openbsd/Config.in" diff --git a/package/netavark/Config.in b/package/netavark/Config.in new file mode 100644 index 0000000000..caac3c4872 --- /dev/null +++ b/package/netavark/Config.in @@ -0,0 +1,10 @@ +config BR2_PACKAGE_NETAVARK + bool "netavark" + depends on BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS + select BR2_PACKAGE_HOST_RUSTC + help + Netavark is a rust based network stack for containers. It + is being designed to work with Podman but is also applicable + for other OCI container management applications. + + https://github.com/containers/netavark diff --git a/package/netavark/netavark.hash b/package/netavark/netavark.hash new file mode 100644 index 0000000000..8fa2c9e647 --- /dev/null +++ b/package/netavark/netavark.hash @@ -0,0 +1,2 @@ +# Locally computed +sha256 09471bd116fdebfd3f7a8100b37809e3a306d0f18e5feee8445ed1e01a22e0aa netavark-v1.14.0-git4-cargo2.tar.gz diff --git a/package/netavark/netavark.mk b/package/netavark/netavark.mk new file mode 100644 index 0000000000..e674da7e5e --- /dev/null +++ b/package/netavark/netavark.mk @@ -0,0 +1,16 @@ +################################################################################ +# +# netavark +# +################################################################################ + +NETAVARK_VERSION = v1.14.0 +NETAVARK_SITE = https://github.com/containers/netavark +NETAVARK_SITE_METHOD = git + +# For protoc +NETAVARK_DEPENDENCIES = host-protobuf + +NETAVARK_CARGO_ENV = PROTOC=$(HOST_DIR)/bin/protoc + +$(eval $(cargo-package)) -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [Buildroot] [PATCH 7/8] package/netavark: new package 2025-02-23 21:14 ` [Buildroot] [PATCH 7/8] package/netavark: " Yann E. MORIN @ 2025-02-23 22:58 ` Julien Olivain 0 siblings, 0 replies; 13+ messages in thread From: Julien Olivain @ 2025-02-23 22:58 UTC (permalink / raw) To: Yann E. MORIN; +Cc: buildroot Hi Yann, Nice patch series! On 23/02/2025 22:14, Yann E. MORIN wrote: > Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> [...] > diff --git a/package/netavark/netavark.mk > b/package/netavark/netavark.mk > new file mode 100644 > index 0000000000..e674da7e5e > --- /dev/null > +++ b/package/netavark/netavark.mk > @@ -0,0 +1,16 @@ > +################################################################################ > +# > +# netavark > +# > +################################################################################ > + > +NETAVARK_VERSION = v1.14.0 > +NETAVARK_SITE = https://github.com/containers/netavark > +NETAVARK_SITE_METHOD = git After a very quick review, I noticed the license information are missing for this package. I'm thinking to _LICENSE, _LICENSE_FILES and license hash. See: https://github.com/containers/netavark/blob/v1.14.0/LICENSE Could you add those info please? Best regards, Julien. _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 13+ messages in thread
* [Buildroot] [PATCH 8/8] package/podman: new package 2025-02-23 21:14 [Buildroot] [PATCH 0/8] package/podman: new package (branch yem/podman) Yann E. MORIN ` (6 preceding siblings ...) 2025-02-23 21:14 ` [Buildroot] [PATCH 7/8] package/netavark: " Yann E. MORIN @ 2025-02-23 21:14 ` Yann E. MORIN 2025-02-23 23:02 ` Julien Olivain 7 siblings, 1 reply; 13+ messages in thread From: Yann E. MORIN @ 2025-02-23 21:14 UTC (permalink / raw) To: buildroot; +Cc: Yann E. MORIN, Christian Stewart Podman is a container manager not unlike Docker, but is daemon-less. Similalry to docker-engine, quite a few kernel config options are required; as they are very similar in goals and features, the options from docker-engine ahve been duplicated for podma. As that was not enough, a few additoinal options have been added after trial-and-error testing. The documentation [0] states that seccomp can be disabled (i.e. not enabled), but we were unable to start a container without seccomp support in podman. So we make that mandatory. Similar to Docker, podman can inject a minimalist init as PID1 in containers, and like Docker, this is optional; podman however can only use catatonit as such an init. Given the size of catatonit (1.3% that of podman!), we do not bother to make it optional, and always enable it. podman requires at least two config files; they can be either per-user or system-wide: - policy.json [1]: defines what signature to accept to validate images; without one such file, podman just refuses to pull images; - registries.conf [2]: defines where to pull iamges from; without it, podman does not know how to pull un-qualified images (i.e. images where the registry is not specified in the path, and which Docker would fetch from the Docker Hub, e.g. "busybox:latest"). For those two files, we provide a very minimal default that allows pulling unqualified images from the Docker Hub, as is traditional, and that allows pulling images which signature can't be verified. Providing actual files is going to be use-case dependent, and interested parties will have to provide their own confoig files, e.g. in a rootfs overlay. Finally, we add a runtime test for podman. The official busybox image on the Docker Hub supports a lot of architectures, of which armv7 which we use for this runtime test. Finding a small image that also supports armv7 on other registries was a bit of a challenge; we eventually found one busybox image on quay.io, but it is not an official busybox image; still, it fits the bill, so we use it. [0] https://podman.io/docs/installation#get-source-code [1] https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md [2] https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Cc: Christian Stewart <christian@aperture.us> --- package/Config.in | 1 + package/podman/Config.in | 38 ++++++ package/podman/podman.hash | 2 + package/podman/podman.mk | 109 ++++++++++++++++ package/podman/policy.json | 7 ++ package/podman/registries.conf | 1 + support/testing/tests/package/test_podman.py | 124 +++++++++++++++++++ 7 files changed, 282 insertions(+) create mode 100644 package/podman/Config.in create mode 100644 package/podman/podman.hash create mode 100644 package/podman/podman.mk create mode 100644 package/podman/policy.json create mode 100644 package/podman/registries.conf create mode 100644 support/testing/tests/package/test_podman.py diff --git a/package/Config.in b/package/Config.in index 6e38f0ef33..fadd867cf0 100644 --- a/package/Config.in +++ b/package/Config.in @@ -2867,6 +2867,7 @@ menu "System tools" source "package/openvmtools/Config.in" source "package/pamtester/Config.in" source "package/petitboot/Config.in" + source "package/podman/Config.in" source "package/polkit/Config.in" source "package/powerpc-utils/Config.in" source "package/procps-ng/Config.in" diff --git a/package/podman/Config.in b/package/podman/Config.in new file mode 100644 index 0000000000..b2c5aacefe --- /dev/null +++ b/package/podman/Config.in @@ -0,0 +1,38 @@ +config BR2_PACKAGE_PODMAN + bool "podman" + depends on BR2_USE_MMU # catatonit, conmon, btrfs-progs, libgpgme + depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS # host-go + depends on BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS # netavark + depends on BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS # libgpgme + depends on BR2_PACKAGE_LIBSECCOMP_ARCH_SUPPORTS # libseccomp + depends on BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_17 # libseccomp + depends on BR2_TOOLCHAIN_HAS_THREADS # conmon, btrfs-progs + depends on BR2_USE_WCHAR # conmon + select BR2_PACKAGE_HOST_GO + select BR2_PACKAGE_CA_CERTIFICATES # runtime + select BR2_PACKAGE_CATATONIT # runtime + select BR2_PACKAGE_CGROUPFS_V2_MOUNT if !BR2_PACKAGE_CGROUPFS_MOUNT && !BR2_INIT_SYSTEMD + select BR2_PACKAGE_CONMON # runtime + select BR2_PACKAGE_IPTABLES # runtime + select BR2_PACKAGE_LIBGPGME + select BR2_PACKAGE_LIBSECCOMP + select BR2_PACKAGE_NETAVARK # runtime + select BR2_PACKAGE_RUNC if !BR2_PACKAGE_CRUN # runtime + help + The best free & open source container tools + + Manage containers, pods, and images with Podman. Seamlessly + work with containers and Kubernetes from your local + environment. + + https://podman.io/ + +comment "podman needs a toolchain w/ headers >= 3.17, threads, wchar" + depends on BR2_USE_MMU + depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS + depends on BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS + depends on BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS + depends on BR2_PACKAGE_LIBSECCOMP_ARCH_SUPPORTS + depends on !BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_17 \ + || !BR2_TOOLCHAIN_HAS_THREADS \ + || !BR2_USE_WCHAR diff --git a/package/podman/podman.hash b/package/podman/podman.hash new file mode 100644 index 0000000000..546427525f --- /dev/null +++ b/package/podman/podman.hash @@ -0,0 +1,2 @@ +# Locally computed +sha256 e5cae3433931e6d6259b72d8d6513661f70cb083ea338068604c47fff5666127 podman-v5.4.0-git4-go2.tar.gz diff --git a/package/podman/podman.mk b/package/podman/podman.mk new file mode 100644 index 0000000000..a04ce92f11 --- /dev/null +++ b/package/podman/podman.mk @@ -0,0 +1,109 @@ +################################################################################ +# +# podman +# +################################################################################ + +PODMAN_VERSION = v5.4.0 +PODMAN_SITE = https://github.com/containers/podman +PODMAN_SITE_METHOD = git + +PODMAN_DEPENDENCIES = host-pkgconf libgpgme + +PODMAN_GOMOD = github.com/containers/podman/v5 +PODMAN_BUILD_TARGETS = cmd/podman +PODMAN_TAGS = selinux + +# https://podman.io/docs/installation#get-source-code mandates that flag be +# set, as device-mapper is not officially supported. +PODMAN_TAGS += exclude_graphdriver_devicemapper + +# This is supposedly optional, but a basic (busybox:latest) image does not +# even start without seccomp support +PODMAN_DEPENDENCIES += libseccomp +PODMAN_TAGS += seccomp + +ifeq ($(BR2_PACKAGE_BTRFS_PROGS),y) +PODMAN_DEPENDENCIES += btrfs-progs +define PODMAN_LINUX_CONFIG_FIXUPS_BTRFS + $(call KCONFIG_ENABLE_OPT,CONFIG_BTRFS_FS) + $(call KCONFIG_ENABLE_OPT,CONFIG_BTRFS_FS_POSIX_ACL) +endef +else +PODMAN_TAGS += exclude_graphdriver_btrfs +endif + +ifeq ($(BR2_PACKAGE_LIBAPPARMOR),y) +PODMAN_DEPENDENCIES += libapparmor +PODMAN_TAGS += apparmor +endif + +ifeq ($(BR2_PACKAGE_SHADOW_SUBORDINATE_IDS),y) +PODMAN_DEPENDENCIES += shadow +PODMAN_TAGS += libsubid +endif + +ifeq ($(BR2_PACKAGE_SYSTEMD),y) +PODMAN_DEPENDENCIES += systemd +PODMAN_TAGS += systemd +endif + +define PODMAN_LINUX_CONFIG_FIXUPS + $(call KCONFIG_ENABLE_OPT,CONFIG_CPUSETS) + $(call KCONFIG_ENABLE_OPT,CONFIG_BPF_SYSCALL) + $(call KCONFIG_ENABLE_OPT,CONFIG_POSIX_MQUEUE) + $(call KCONFIG_ENABLE_OPT,CONFIG_MEMCG) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUPS) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_SCHED) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_FREEZER) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_DEVICE) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_CPUACCT) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_PIDS) + $(call KCONFIG_ENABLE_OPT,CONFIG_CGROUP_BPF) + $(call KCONFIG_ENABLE_OPT,CONFIG_NAMESPACES) + $(call KCONFIG_ENABLE_OPT,CONFIG_UTS_NS) + $(call KCONFIG_ENABLE_OPT,CONFIG_IPC_NS) + $(call KCONFIG_ENABLE_OPT,CONFIG_PID_NS) + $(call KCONFIG_ENABLE_OPT,CONFIG_USER_NS) + $(call KCONFIG_ENABLE_OPT,CONFIG_NET_NS) + $(call KCONFIG_ENABLE_OPT,CONFIG_SECCOMP) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_ADVANCED) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XTABLES) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XT_MATCH_ADDRTYPE) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XT_MATCH_COMMENT) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XT_MATCH_CONNTRACK) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XT_MARK) + $(call KCONFIG_ENABLE_OPT,CONFIG_NETFILTER_XT_MATCH_IPVS) + $(call KCONFIG_ENABLE_OPT,CONFIG_NF_CONNTRACK) + $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_IPTABLES) + $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_FILTER) + $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_NAT) + $(call KCONFIG_ENABLE_OPT,CONFIG_IP_NF_TARGET_MASQUERADE) + $(call KCONFIG_ENABLE_OPT,CONFIG_BRIDGE) + $(call KCONFIG_ENABLE_OPT,CONFIG_BRIDGE_NETFILTER) + $(call KCONFIG_ENABLE_OPT,CONFIG_NET_CORE) + $(call KCONFIG_ENABLE_OPT,CONFIG_VETH) + $(call KCONFIG_ENABLE_OPT,CONFIG_OVERLAY_FS) + $(call KCONFIG_ENABLE_OPT,CONFIG_KEYS) + $(PODMAN_LINUX_CONFIG_FIXUPS_BTRFS) +endef + +define PODMAN_CONFIG + $(Q)$(INSTALL) -D -m 0644 \ + $(PODMAN_PKGDIR)/registries.conf \ + $(TARGET_DIR)/etc/containers/registries.conf + $(Q)$(INSTALL) -D -m 0644 \ + $(PODMAN_PKGDIR)/policy.json \ + $(TARGET_DIR)/etc/containers/policy.json +endef +PODMAN_POST_INSTALL_TARGET_HOOKS += PODMAN_CONFIG + +define PODMAN_HELPERS + $(Q)mkdir -p $(TARGET_DIR)/usr/libexec/podman + $(Q)ln -sf ../../bin/netavark $(TARGET_DIR)/usr/libexec/podman/netavark + $(Q)ln -sf ../../bin/catatonit $(TARGET_DIR)/usr/libexec/podman/catatonit +endef +PODMAN_POST_INSTALL_TARGET_HOOKS += PODMAN_HELPERS + +$(eval $(golang-package)) diff --git a/package/podman/policy.json b/package/podman/policy.json new file mode 100644 index 0000000000..9333053f93 --- /dev/null +++ b/package/podman/policy.json @@ -0,0 +1,7 @@ +{ + "default": [ + { + "type": "insecureAcceptAnything" + } + ] +} diff --git a/package/podman/registries.conf b/package/podman/registries.conf new file mode 100644 index 0000000000..d44d892da3 --- /dev/null +++ b/package/podman/registries.conf @@ -0,0 +1 @@ +unqualified-search-registries = ["docker.io"] diff --git a/support/testing/tests/package/test_podman.py b/support/testing/tests/package/test_podman.py new file mode 100644 index 0000000000..ba6d615849 --- /dev/null +++ b/support/testing/tests/package/test_podman.py @@ -0,0 +1,124 @@ +import infra.basetest +import json +import os + + +class TestPodman(infra.basetest.BRTest): + config = \ + """ + BR2_arm=y + BR2_cortex_a9=y + BR2_ARM_ENABLE_VFP=y + BR2_TOOLCHAIN_EXTERNAL=y + BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y + BR2_PER_PACKAGE_DIRECTORIES=y + BR2_SYSTEM_DHCP="eth0" + BR2_LINUX_KERNEL=y + BR2_LINUX_KERNEL_CUSTOM_VERSION=y + BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.10.202" + BR2_LINUX_KERNEL_DEFCONFIG="vexpress" + BR2_LINUX_KERNEL_DTS_SUPPORT=y + BR2_LINUX_KERNEL_INTREE_DTS_NAME="vexpress-v2p-ca9" + BR2_PACKAGE_CA_CERTIFICATES=y + BR2_PACKAGE_PODMAN=y + BR2_PACKAGE_HOST_GO_BIN=y + BR2_TARGET_ROOTFS_EXT2=y + BR2_TARGET_ROOTFS_EXT2_SIZE="256M" + # BR2_TARGET_ROOTFS_TAR is not set + """ + + def test_run(self): + kernel_file = os.path.join(self.builddir, 'images', 'zImage') + dtb_file = os.path.join(self.builddir, 'images', 'vexpress-v2p-ca9.dtb') + ext2_file = os.path.join(self.builddir, 'images', 'rootfs.ext2') + self.emulator.boot( + arch='armv5', + kernel=kernel_file, + kernel_cmdline=[ + 'root=/dev/mmcblk0', + 'rootwait', + 'console=ttyAMA0', + ], + options=[ + '-M', 'vexpress-a9', + '-dtb', dtb_file, + '-drive', f'file={ext2_file},if=sd,format=raw', + ] + ) + self.emulator.login() + + # The podman binary is huge, so it takes time to load... + # Next calls will be faster, though, as it is going to be cached. + self.assertRunOk('podman --version', timeout=30) + + # Check for an empty image storage + output, exit_code = self.emulator.run('podman image ls --format "{{ json }}"') + img_info = json.loads("".join(output)) + self.assertEqual(len(img_info), 0, f"{len(img_info)} image(s) already present") + + # Pull an image; it can take time: network, hash checksums... + self.assertRunOk('podman image pull busybox:1.37.0', timeout=60) + output, exit_code = self.emulator.run('podman image ls --format "{{ json }}"') + img_info = json.loads("".join(output)) + self.assertEqual(len(img_info), 1, f"{len(img_info)} image(s), expecting 1") + self.assertTrue("Id" in img_info[0], '"Id" not in img_info[0]') + self.assertTrue("Digest" in img_info[0], '"Digest" not in img_info[0]') + self.assertEqual(img_info[0]["Names"][0], "docker.io/library/busybox:1.37.0") + + output, _ = self.emulator.run('echo ${br_container}') + self.assertEqual(output[0], "", "Already in a container") + + # Spawn the container; that can take a bit of time + self.assertRunOk( + "podman container run --rm -ti -e PS1 -e br_container=podman busybox:1.37.0", + timeout=60, + ) + # Twist! The command above is still running, but the shell it + # started exposes the same prompt we expect. This is all what we want. + output, _ = self.emulator.run('echo ${br_container}') + self.assertEqual(output[0], "podman", "Not in a podman container") + + # Check that pid1 is the shell + output, _ = self.emulator.run('readlink /proc/1/exe') + self.assertEqual(output[0], "/bin/sh", f"PID1 is {output[0]}, should be /bin/sh") + + # Exit the container + self.assertRunOk("exit 0") + # Twist, take two! We are now back to the shell in the VM. + output, _ = self.emulator.run('echo ${br_container}') + self.assertEqual(output[0], "", "Still in a container") + + # Spawn a container, round two, but with an injected init this time + self.assertRunOk("podman container run --rm -ti -e PS1 --init -e br_container=podman busybox:1.37.0", timeout=60) + output, _ = self.emulator.run('echo ${br_container}') + self.assertEqual(output[0], "podman", "Not in a podman container") + + # Check that pid1 is the init injected by podman + output, _ = self.emulator.run('readlink /proc/1/exe') + self.assertEqual(output[0], "/run/podman-init", f"PID1 is {output[0]}, should be /run/podman-init") + + # Exit the container + self.assertRunOk("exit 0") + output, _ = self.emulator.run('echo ${br_container}') + self.assertEqual(output[0], "", "Still in a container") + + # Remove the image + self.assertRunOk('podman image rm busybox:1.37.0') + output, exit_code = self.emulator.run('podman image ls --format "{{ json }}"') + img_info = json.loads("".join(output)) + self.assertEqual(len(img_info), 0, f"{len(img_info)} image(s) still present, expecting 0") + + # Use an image from another registry, spawn without pulling first + self.assertRunOk( + "podman container run --rm -ti -e PS1 -e br_container=podman quay.io/prometheus/busybox:latest", + timeout=60, + ) + output, _ = self.emulator.run('echo ${br_container}') + self.assertEqual(output[0], "podman", "Not in a podman container") + self.assertRunOk("exit 0") + output, _ = self.emulator.run('echo ${br_container}') + self.assertEqual(output[0], "", "Still in a container") + self.assertRunOk('podman image prune -af') + output, exit_code = self.emulator.run('podman image ls --format "{{ json }}"') + img_info = json.loads("".join(output)) + self.assertEqual(len(img_info), 0, f"{len(img_info)} image(s) still present, expecting 0") -- 2.47.0 _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [Buildroot] [PATCH 8/8] package/podman: new package 2025-02-23 21:14 ` [Buildroot] [PATCH 8/8] package/podman: " Yann E. MORIN @ 2025-02-23 23:02 ` Julien Olivain 2025-02-24 19:21 ` Yann E. MORIN 0 siblings, 1 reply; 13+ messages in thread From: Julien Olivain @ 2025-02-23 23:02 UTC (permalink / raw) To: Yann E. MORIN; +Cc: buildroot, Christian Stewart Hi Yann, On 23/02/2025 22:14, Yann E. MORIN wrote: > Podman is a container manager not unlike Docker, but is daemon-less. [...] > diff --git a/package/podman/podman.mk b/package/podman/podman.mk > new file mode 100644 > index 0000000000..a04ce92f11 > --- /dev/null > +++ b/package/podman/podman.mk > @@ -0,0 +1,109 @@ > +################################################################################ > +# > +# podman > +# > +################################################################################ > + > +PODMAN_VERSION = v5.4.0 > +PODMAN_SITE = https://github.com/containers/podman > +PODMAN_SITE_METHOD = git I have the same comment as for netavark: I noticed the license information are missing for this package. I'm thinking to _LICENSE, _LICENSE_FILES and license hash. See: https://github.com/containers/podman/blob/v5.4.0/LICENSE Could you add those info please? Best regards, Julien. _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [Buildroot] [PATCH 8/8] package/podman: new package 2025-02-23 23:02 ` Julien Olivain @ 2025-02-24 19:21 ` Yann E. MORIN 0 siblings, 0 replies; 13+ messages in thread From: Yann E. MORIN @ 2025-02-24 19:21 UTC (permalink / raw) To: Julien Olivain; +Cc: buildroot, Christian Stewart Julien, All, On 2025-02-24 00:02 +0100, Julien Olivain spake thusly: > On 23/02/2025 22:14, Yann E. MORIN wrote: > > Podman is a container manager not unlike Docker, but is daemon-less. [--SNIP--] > > +PODMAN_VERSION = v5.4.0 > > +PODMAN_SITE = https://github.com/containers/podman > > +PODMAN_SITE_METHOD = git > I have the same comment as for netavark: > I noticed the license information are missing for this > package. I'm thinking to _LICENSE, _LICENSE_FILES and > license hash. Ah, damn, I was looking at my series and wondering what I had missed, but that completely eluded me... > Could you add those info please? Sure thing, thanks for spotting that! Regards, Yann E. MORIN. -- .-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------' _______________________________________________ buildroot mailing list buildroot@buildroot.org https://lists.buildroot.org/mailman/listinfo/buildroot ^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2025-02-25 13:45 UTC | newest] Thread overview: 13+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2025-02-23 21:14 [Buildroot] [PATCH 0/8] package/podman: new package (branch yem/podman) Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 1/8] support/testing: set date in emulated machine Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 2/8] package/shadow: install to staging for subids Yann E. MORIN 2025-02-25 13:46 ` Raphael Pavlidis 2025-02-23 21:14 ` [Buildroot] [PATCH 3/8] package/conmon: depends on systemd when enabled Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 4/8] package/skopeo: add target variant Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 5/8] package/cgroupfs-mount: tweak the kernel config Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 6/8] package/cgroupfs-v2-mount: new package Yann E. MORIN 2025-02-23 21:14 ` [Buildroot] [PATCH 7/8] package/netavark: " Yann E. MORIN 2025-02-23 22:58 ` Julien Olivain 2025-02-23 21:14 ` [Buildroot] [PATCH 8/8] package/podman: " Yann E. MORIN 2025-02-23 23:02 ` Julien Olivain 2025-02-24 19:21 ` Yann E. MORIN
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox