[cip-dev][isar-cip-core][PATCH v2 0/5] switch to rootless build

[cip-dev][isar-cip-core][PATCH v2 0/5] switch to rootless build

[Quirin Gylstorff]

This patchset contains the necessary changes to switch
isar-cip-core to the new rootless build.

Changes v2:
 - add Debian release requirement for rootless builds
 - use kas purge in .reproducible-check-ci.yml
 - use correct kas-container

Quirin Gylstorff (5):
  update to kas 5.4
  update Isar to contain rootless changes
  use run_priviledged instead of sudo
  switch to isar-rootless
  update README.md for rootless build

 .gitlab-ci.yml                          |   2 +-
 .reproducible-check-ci.yml              |   3 +-
 Kconfig                                 |   2 +-
 README.md                               |   8 +-
 classes-recipe/image_uuid.bbclass       |   4 +-
 classes-recipe/read-only-rootfs.bbclass |   8 +-
 kas-cip.yml                             |   4 +-
 kas-container                           | 300 +++++++++++++-----------
 8 files changed, 176 insertions(+), 155 deletions(-)

-- 
2.53.0

[cip-dev][isar-cip-core][PATCH v2 1/5] update to kas 5.4

[Quirin Gylstorff]

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
 .gitlab-ci.yml |   2 +-
 Kconfig        |   2 +-
 kas-cip.yml    |   2 +-
 kas-container  | 300 ++++++++++++++++++++++++++-----------------------
 4 files changed, 164 insertions(+), 142 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b53def4..1e61cb0 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -33,7 +33,7 @@ stages:
   - cve-check
 
 default:
-  image: ghcr.io/siemens/kas/kas-isar:5.2
+  image: ghcr.io/siemens/kas/kas-isar:5.4
   before_script:
     - export http_proxy=$HTTP_PROXY
     - export https_proxy=$HTTPS_PROXY
diff --git a/Kconfig b/Kconfig
index 438234c..5003bed 100644
--- a/Kconfig
+++ b/Kconfig
@@ -17,7 +17,7 @@ config KAS_INCLUDE_MAIN
 
 config KAS_BUILD_SYSTEM
 	string
-	default "isar"
+	default "isar-privileged"
 
 config ARCH_AMD64
 	bool
diff --git a/kas-cip.yml b/kas-cip.yml
index 23bbba4..6badc7d 100644
--- a/kas-cip.yml
+++ b/kas-cip.yml
@@ -15,7 +15,7 @@ header:
 distro: cip-core-trixie
 target: cip-core-image
 
-build_system: isar
+build_system: isar-privileged
 
 repos:
   cip-core:
diff --git a/kas-container b/kas-container
index 993f0bb..631e40c 100755
--- a/kas-container
+++ b/kas-container
@@ -27,7 +27,7 @@
 
 set -e
 
-KAS_CONTAINER_SCRIPT_VERSION="5.2"
+KAS_CONTAINER_SCRIPT_VERSION="5.4"
 KAS_IMAGE_VERSION_DEFAULT="${KAS_CONTAINER_SCRIPT_VERSION}"
 KAS_CONTAINER_IMAGE_DISTRO_DEFAULT=""
 KAS_CONTAINER_IMAGE_PATH_DEFAULT="ghcr.io/siemens/kas"
@@ -49,9 +49,10 @@ usage()
 	printf "%b" "\nPositional arguments:\n"
 	printf "%b" "build\t\t\tCheck out repositories and build target.\n"
 	printf "%b" "checkout\t\tCheck out repositories but do not build.\n"
+	printf "%b" "diff\t\t\tCompare two kas configurations.\n"
 	printf "%b" "dump\t\t\tCheck out repositories and write flat version\n"
 	printf "%b" "    \t\t\tof config to stdout.\n"
-	printf "%b" "lock\t\t\tCreate and update kas project lockfiles\n"
+	printf "%b" "lock\t\t\tCreate and update kas project lockfiles.\n"
 	printf "%b" "shell\t\t\tRun a shell in the build environment.\n"
 	printf "%b" "for-all-repos\t\tRun specified command in each repository.\n"
 	printf "%b" "clean\t\t\tClean build artifacts, keep sstate cache and " \
@@ -61,20 +62,19 @@ usage()
 	printf "%b" "cleanall\t\tClean build artifacts, sstate cache and " \
 		    "downloads.\n"
 	printf "%b" "purge\t\t\tRemove all data managed by kas. Run with '--dry-run'\n"
-	printf "%b" "     \t\t\tto check what would be removed\n"
+	printf "%b" "     \t\t\tto check what would be removed.\n"
 	printf "%b" "menu\t\t\tProvide configuration menu and trigger " \
 		    "configured build.\n"
 	printf "%b" "\nOptional arguments:\n"
-	printf "%b" "--isar\t\t\tUse kas-isar container to build Isar image. To force\n"
-	printf "%b" "      \t\t\tthe use of run0 over sudo, set KAS_SUDO_CMD=run0.\n"
-	printf "%b" "--with-loop-dev		Pass a loop device to the " \
-		    "container. Only required if\n"
-	printf "%b" "\t\t\tloop-mounting is used by recipes.\n"
+	printf "%b" "--isar-privileged\tRun an Isar build in privileged mode. " \
+	            "To force the use\n"
+	printf "%b" "\t\t\tof run0 over sudo, set KAS_SUDO_CMD=run0.\n"
+	printf "%b" "--isar-rootless\t\tRun an Isar build in rootless mode.\n"
 	printf "%b" "--runtime-args\t\tAdditional arguments to pass to the " \
-			"container runtime\n"
+			"container runtime.\n"
 	printf "%b" "\t\t\tfor running the build.\n"
 	printf "%b" "-l, --log-level\t\tSet log level (default=info).\n"
-	printf "%b" "--version\t\tprint program version.\n"
+	printf "%b" "--version\t\tPrint program version.\n"
 	printf "%b" "--ssh-dir\t\tDirectory containing SSH configurations.\n"
 	printf "%b" "\t\t\tAvoid \$HOME/.ssh unless you fully trust the " \
 		    "container.\n"
@@ -83,13 +83,15 @@ usage()
 	printf "%b" "\t\t\tAvoid \$HOME/.aws unless you fully trust the " \
 		    "container.\n"
 	printf "%b" "--git-credential-store\tFile path to the git credential " \
-		    "store\n"
+		    "store.\n"
+	printf "%b" "--git-credential-socket\tPath to the git credential cache " \
+	       "socket.\n"
 	printf "%b" "--no-proxy-from-env\tDo not inherit proxy settings from " \
 		    "environment.\n"
 	printf "%b" "--repo-ro\t\tMount current repository read-only\n" \
-		    "\t\t\t(default for build command)\n"
+		    "\t\t\t(default for build command).\n"
 	printf "%b" "--repo-rw\t\tMount current repository writable\n" \
-		    "\t\t\t(default for shell command)\n"
+		    "\t\t\t(default for shell command).\n"
 	printf "%b" "-h, --help\t\tShow this help message and exit.\n"
 	printf "%b" "\n"
 	printf "%b" "You can force the use of podman over docker using " \
@@ -143,11 +145,6 @@ prepare_sudo_cmd()
 
 enable_isar_mode()
 {
-	if [ -n "${ISAR_MODE}" ]; then
-		return
-	fi
-	ISAR_MODE=1
-
 	KAS_CONTAINER_IMAGE_NAME_DEFAULT="kas-isar"
 	KAS_ISAR_ARGS="--privileged"
 
@@ -159,14 +156,38 @@ enable_isar_mode()
 		export PATH="${PATH}:/usr/sbin"
 	elif [ "${KAS_DOCKER_ROOTLESS}" = "1" ]; then
 		prepare_sudo_cmd
-		export DOCKER_HOST="${DOCKER_HOST:-unix:///var/run/docker.sock}"
-		debug "kas-isar does not support rootless docker. Using system docker"
+		DOCKER_HOST_DEFAULT="$(docker context inspect default --format '{{.Endpoints.docker.Host}}')"
+		export DOCKER_HOST="${DOCKER_HOST:-$DOCKER_HOST_DEFAULT}"
+		debug "kas-isar does not support rootless docker. Using system docker in $DOCKER_HOST"
 		# force use of well-known system docker socket
 		KAS_CONTAINER_COMMAND="${_KAS_SUDO_CMD} ${KAS_CONTAINER_COMMAND}"
 		KAS_DOCKER_ROOTLESS=0
 	fi
 }
 
+enable_isar_rootless_mode()
+{
+	KAS_CONTAINER_IMAGE_NAME_DEFAULT="kas-isar"
+
+	# Use --privileged to pass the ambient capabilities into the container.
+	# When calling from the user session (podman or docker-rootless), this
+	# is fundamentally different from the system docker run --privileged
+	if [ "${KAS_CONTAINER_ENGINE}" = "podman" ]; then
+		KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --userns=keep-id --privileged"
+	elif [ "${KAS_DOCKER_ROOTLESS}" = "1" ]; then
+		KAS_ISAR_ARGS="--privileged"
+	else
+		# we don't need --privileged, but we need to run with SYS_ADMIN
+		# to be able to unshare.
+		KAS_ISAR_ARGS=" \
+			--security-opt seccomp=unconfined \
+			--security-opt apparmor=unconfined \
+			--security-opt systempaths=unconfined \
+			--cap-add=SYS_ADMIN \
+		"
+	fi
+}
+
 enable_oe_mode()
 {
 	if [ "${KAS_CONTAINER_ENGINE}" = "podman" ]; then
@@ -174,6 +195,7 @@ enable_oe_mode()
 		# calling "podman run" has a 1:1 mapping
 		KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --userns=keep-id"
 	fi
+	BUILD_SYSTEM="openembedded"
 }
 
 enable_unpriv_userns_docker()
@@ -210,6 +232,19 @@ check_and_expand()
 	realpath -e "$_varval"
 }
 
+# SC2034: DIR appears unused (ignore, as they are used inside eval)
+# shellcheck disable=2034
+setup_kas_dirs()
+{
+	KAS_WORK_DIR="${KAS_WORK_DIR:-$(pwd)}"
+	KAS_WORK_DIR="$(check_and_expand KAS_WORK_DIR required)"
+	KAS_BUILD_DIR="$(check_and_expand KAS_BUILD_DIR create)"
+	KAS_REPO_REF_DIR="$(check_and_expand KAS_REPO_REF_DIR required)"
+	DL_DIR="$(check_and_expand DL_DIR createrec)"
+	SSTATE_DIR="$(check_and_expand SSTATE_DIR createrec)"
+	KAS_BUILDTOOLS_DIR="$(check_and_expand KAS_BUILDTOOLS_DIR createrec)"
+}
+
 # Params: FILE
 # Returns: root repo dir of file
 repo_path_of_file()
@@ -260,14 +295,6 @@ forward_dir()
 	fi
 }
 
-check_docker_rootless()
-{
-	KAS_DOCKER_ROOTLESS=0
-	if [ "$(docker context show)" = "rootless" ]; then
-		KAS_DOCKER_ROOTLESS=1
-	fi
-}
-
 enable_docker_rootless()
 {
 	warning "Rootless docker used, only limited functionality available."
@@ -281,118 +308,44 @@ enable_docker_rootless()
 	KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -e KAS_DOCKER_ROOTLESS=1"
 }
 
-KAS_GIT_OVERLAY_FILE=""
-kas_container_cleanup()
-{
-	if [ -f "${KAS_GIT_OVERLAY_FILE}" ]; then
-		trace rm -f "${KAS_GIT_OVERLAY_FILE}"
-	fi
-}
-trap kas_container_cleanup EXIT INT TERM
-
 set_container_image_var()
 {
+	# if the image is explicitly set, use that
+	if [ -n "${KAS_CONTAINER_IMAGE}" ]; then
+		return
+	fi
 	KAS_IMAGE_VERSION="${KAS_IMAGE_VERSION:-${KAS_IMAGE_VERSION_DEFAULT}}"
 	KAS_CONTAINER_IMAGE_DISTRO="${KAS_CONTAINER_IMAGE_DISTRO:-${KAS_CONTAINER_IMAGE_DISTRO_DEFAULT}}"
 	KAS_CONTAINER_IMAGE_NAME="${KAS_CONTAINER_IMAGE_NAME:-${KAS_CONTAINER_IMAGE_NAME_DEFAULT}}"
 	KAS_CONTAINER_IMAGE_PATH="${KAS_CONTAINER_IMAGE_PATH:-${KAS_CONTAINER_IMAGE_PATH_DEFAULT}}"
-	KAS_CONTAINER_IMAGE_DEFAULT="${KAS_CONTAINER_IMAGE_PATH}/${KAS_CONTAINER_IMAGE_NAME}:${KAS_IMAGE_VERSION}"
-	KAS_CONTAINER_IMAGE="${KAS_CONTAINER_IMAGE:-${KAS_CONTAINER_IMAGE_DEFAULT}}"
+	KAS_CONTAINER_IMAGE="${KAS_CONTAINER_IMAGE_PATH}/${KAS_CONTAINER_IMAGE_NAME}:${KAS_IMAGE_VERSION}"
 	if [ -n "${KAS_CONTAINER_IMAGE_DISTRO}" ]; then
 		KAS_CONTAINER_IMAGE="${KAS_CONTAINER_IMAGE}-${KAS_CONTAINER_IMAGE_DISTRO}"
 	fi
 }
 
-# SC2034: DIR appears unused (ignore, as they are used inside eval)
-# shellcheck disable=2034
-setup_kas_dirs()
-{
-	KAS_WORK_DIR="${KAS_WORK_DIR:-$(pwd)}"
-	KAS_WORK_DIR="$(check_and_expand KAS_WORK_DIR required)"
-	KAS_BUILD_DIR="$(check_and_expand KAS_BUILD_DIR create)"
-	KAS_REPO_REF_DIR="$(check_and_expand KAS_REPO_REF_DIR required)"
-	DL_DIR="$(check_and_expand DL_DIR createrec)"
-	SSTATE_DIR="$(check_and_expand SSTATE_DIR createrec)"
-	KAS_BUILDTOOLS_DIR="$(check_and_expand KAS_BUILDTOOLS_DIR createrec)"
-}
-setup_kas_dirs
-
-KAS_CONTAINER_ENGINE="${KAS_CONTAINER_ENGINE:-${KAS_DOCKER_ENGINE}}"
-if [ -z "${KAS_CONTAINER_ENGINE}" ]; then
-	# Try to auto-detect a container engine
-	if command -v docker >/dev/null; then
-		case $(docker -v 2>/dev/null) in
-		podman*)
-			# The docker command is an alias for podman
-			KAS_CONTAINER_ENGINE=podman
-			;;
-		Docker*)
-			# The docker command is the real docker
-			KAS_CONTAINER_ENGINE=docker
-			;;
-		*)
-			# The docker command is an unknown engine
-			fatal_error "docker command found, but unknown engine detected"
-		esac
-	elif command -v podman >/dev/null; then
-		KAS_CONTAINER_ENGINE=podman
-	else
-		fatal_error "no container engine found, need docker or podman"
-	fi
-fi
-
-KAS_RUNTIME_ARGS="--log-driver=none --user=root"
-
-case "${KAS_CONTAINER_ENGINE}" in
-docker)
-	KAS_CONTAINER_COMMAND="docker"
-	enable_unpriv_userns_docker
-	check_docker_rootless
-	;;
-podman)
-	KAS_CONTAINER_COMMAND="podman"
-	KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --security-opt label=disable"
-	;;
-*)
-	fatal_error "unknown container engine '${KAS_CONTAINER_ENGINE}'"
-	;;
-esac
-
-# parse kas-container options
+# parse kas-container options, leave build system empty to distinguish between
+# explicitly set via flag and implicitly via config.
+BUILD_SYSTEM=""
+KAS_OPTIONS_DIRECT=""
+KAS_EXTRA_RUNTIME_ARGS=""
 while [ $# -gt 0 ]; do
 	case "$1" in
-	--isar)
-		enable_isar_mode
+	--isar | --isar-privileged)
+		if [ "$1" = "--isar" ]; then
+			warning "The semantic of '--isar' might change in the" \
+				"future. Please use '--isar-privileged' instead."
+		fi
+		BUILD_SYSTEM="isar-privileged"
 		shift 1
 		;;
-	--with-loop-dev)
-		if ! KAS_LOOP_DEV=$(/sbin/losetup -f 2>/dev/null); then
-			if [ "$(id -u)" -eq 0 ]; then
-				fatal_error "loop device not available!"
-			fi
-			prepare_sudo_cmd
-			if ! [ "$KAS_SUDO_CMD" = "sudo" ]; then
-				fatal_error '--with-loop-dev requires sudo for device setup.'
-			fi
-			sudo_command="/sbin/losetup -f"
-			sudo_message="[sudo] enter password to setup loop"
-			sudo_message="$sudo_message devices by calling"
-			sudo_message="$sudo_message '$sudo_command': "
-			# SC2086: Double quote to prevent globbing and word splitting.
-			# shellcheck disable=2086
-			if ! KAS_LOOP_DEV=$(sudo -p "$sudo_message" $sudo_command \
-				2>/dev/null); then
-				fatal_error "loop device setup unsuccessful!" \
-				            "try calling '$sudo_command' with root" \
-				            "permissions manually."
-			fi
-		fi
-		KAS_WITH_LOOP_DEV="--device ${KAS_LOOP_DEV}"
+	--isar-rootless)
+		BUILD_SYSTEM="isar-rootless"
 		shift 1
 		;;
-	--runtime-args|--docker-args)
+	--runtime-args | --docker-args)
 		[ $# -gt 0 ] || usage
-		KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} $2"
+		KAS_EXTRA_RUNTIME_ARGS=" $2"
 		shift 2
 		;;
 	--ssh-dir)
@@ -417,6 +370,13 @@ while [ $# -gt 0 ]; do
 		KAS_GIT_CREDENTIAL_STORE="$2"
 		shift 2
 		;;
+
+	--git-credential-socket)
+		[ $# -gt 2 ] || usage
+		KAS_GIT_CREDENTIAL_SOCKET="$2"
+		shift 2
+		;;
+
 	--no-proxy-from-env)
 		KAS_NO_PROXY_FROM_ENV=1
 		shift 1
@@ -446,19 +406,19 @@ while [ $# -gt 0 ]; do
 	--*)
 		usage
 		;;
-	clean|cleansstate|cleanall|purge)
+	clean | cleansstate | cleanall | purge)
 		KAS_REPO_MOUNT_OPT_DEFAULT="ro"
 		KAS_CMD=$1
 		shift 1
 		break
 		;;
-	shell|lock)
+	shell | lock)
 		KAS_REPO_MOUNT_OPT_DEFAULT="rw"
 		KAS_CMD=$1
 		shift 1
 		break
 		;;
-	build|checkout|for-all-repos|menu)
+	build | checkout | for-all-repos | menu)
 		KAS_REPO_MOUNT_OPT_DEFAULT="ro"
 		KAS_CMD=$1
 		shift 1
@@ -486,6 +446,10 @@ while [ $# -gt 0 ]; do
 	esac
 done
 
+KAS_RUNTIME_ARGS="--log-driver=none --user=root"
+
+setup_kas_dirs
+
 [ -n "${KAS_CMD}" ] || usage
 
 KAS_EXTRA_BITBAKE_ARGS=0
@@ -494,17 +458,17 @@ KAS_FILES=
 # parse kas sub-command options
 while [ $# -gt 0 ] && [ $KAS_EXTRA_BITBAKE_ARGS -eq 0 ]; do
 	case "$1" in
-	--format|--indent|--provenance|--skip|--target|--task)
+	--format | --indent | --provenance | --skip | --target | --task)
 		KAS_OPTIONS="${KAS_OPTIONS} $1 $2"
 		shift 1
 		shift 1 || KAS_OPTIONS="--help"
 		;;
-	-c|--cmd|--command)
+	-c | --cmd | --command)
 		KAS_BITBAKE_C_OPTION_ARGS="$2"
 		shift 1
 		shift 1 || KAS_OPTIONS="--help"
 		;;
-	-E|--preserve-env)
+	-E | --preserve-env)
 		fatal_error "$1 is not supported with ${KAS_CONTAINER_SELF_NAME}"
 		;;
 	--)
@@ -563,10 +527,10 @@ if [ "${KAS_CMD}" = "menu" ]; then
 	if [ "$(echo "${KAS_FIRST_FILES}" | wc -w)" -ne "1" ]; then
 		fatal_error "menu plugin only supports a single Kconfig file"
 	fi
-	BUILD_SYSTEM=$(tr '\n' '\f' 2>/dev/null < "${KAS_FIRST_FILES}" | \
+	BUILD_SYSTEM=${BUILD_SYSTEM:-$(tr '\n' '\f' 2>/dev/null < "${KAS_FIRST_FILES}" |
 		sed -e 's/\(.*\fconfig KAS_BUILD_SYSTEM\f\(.*\)\|.*\)/\2/' \
 		    -e 's/\f\([[:alpha:]].*\|$\)//' \
-		    -e 's/.*default \"\(.*\)\".*/\1/')
+		    -e 's/.*default \"\(.*\)\".*/\1/')}
 else
 	if [ -z "${KAS_FIRST_FILES}" ]; then
 		KAS_FIRST_FILES="${KAS_WORK_DIR}/.config.yaml"
@@ -574,20 +538,60 @@ else
 
 	# We only get the first build system and let kas check if mixed
 	_KAS_FIRST_FILE=$(echo "${KAS_FIRST_FILES}" | awk '{print $1}')
-	BUILD_SYSTEM=$(grep -e "^build_system: " "${_KAS_FIRST_FILE}" 2>/dev/null | \
-		sed 's/build_system:[ ]\+//')
+	BUILD_SYSTEM=${BUILD_SYSTEM:-$(grep -e "^build_system: " "${_KAS_FIRST_FILE}" 2>/dev/null |
+		sed 's/build_system:[ ]\+//')}
+fi
+
+KAS_CONTAINER_ENGINE="${KAS_CONTAINER_ENGINE:-${KAS_DOCKER_ENGINE}}"
+if [ -z "${KAS_CONTAINER_ENGINE}" ]; then
+	# Try to auto-detect a container engine
+	# Defaults if there are multiple options:
+	# podman if build system is isar-rootless, docker otherwise
+	if [ "${BUILD_SYSTEM}" = "isar-rootless" ] && command -v podman >/dev/null 2>&1; then
+		KAS_CONTAINER_ENGINE=podman
+	elif command -v docker >/dev/null 2>&1 && docker -v 2>/dev/null | grep -q '^Docker'; then
+		KAS_CONTAINER_ENGINE=docker
+	elif command -v podman >/dev/null 2>&1; then
+		KAS_CONTAINER_ENGINE=podman
+	else
+		fatal_error "no container engine found, need docker or podman"
+	fi
 fi
 
-if [ "${BUILD_SYSTEM}" = "isar" ]; then
+KAS_DOCKER_ROOTLESS=0
+case "${KAS_CONTAINER_ENGINE}" in
+docker)
+	KAS_CONTAINER_COMMAND="docker"
+	enable_unpriv_userns_docker
+	if [ "$(docker context show)" = "rootless" ]; then
+		KAS_DOCKER_ROOTLESS=1
+	fi
+	;;
+podman)
+	KAS_CONTAINER_COMMAND="podman"
+	KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --security-opt label=disable"
+	;;
+*)
+	fatal_error "unknown container engine '${KAS_CONTAINER_ENGINE}'"
+	;;
+esac
+
+if [ "${BUILD_SYSTEM}" = "isar" ] || [ "${BUILD_SYSTEM}" = "isar-privileged" ]; then
 	enable_isar_mode
-elif [ -z "${ISAR_MODE}" ]; then
+elif [ "${BUILD_SYSTEM}" = "isar-rootless" ]; then
+	enable_isar_rootless_mode
+else
 	enable_oe_mode
 fi
 
 # clean can be executed without config, hence manually forward the build system
-if [ "${ISAR_MODE}" = "1" ] && echo "${KAS_CMD}" | grep -qe "^clean\|purge"; then
-	KAS_OPTIONS="${KAS_OPTIONS} --isar"
-fi
+case "${BUILD_SYSTEM}" in
+isar*)
+	if echo "${KAS_CMD}" | grep -qe "^clean\|purge"; then
+		KAS_OPTIONS="${KAS_OPTIONS} --${BUILD_SYSTEM}"
+	fi
+	;;
+esac
 
 set_container_image_var
 
@@ -632,6 +636,16 @@ forward_dir KAS_BUILDTOOLS_DIR "/buildtools" "rw"
 
 if git_com_dir=$(git -C "${KAS_REPO_DIR}" rev-parse --git-common-dir 2>/dev/null) \
 	&& [ "$git_com_dir" != "$(git -C "${KAS_REPO_DIR}" rev-parse --git-dir)" ]; then
+
+	KAS_GIT_OVERLAY_FILE=""
+	kas_container_cleanup()
+	{
+		if [ -f "${KAS_GIT_OVERLAY_FILE}" ]; then
+			trace rm -f "${KAS_GIT_OVERLAY_FILE}"
+		fi
+	}
+	trap kas_container_cleanup EXIT INT TERM
+
 	# If (it's a git repo) and the common dir isn't the git-dir, it is shared worktree and
 	# we have to mount the common dir in the container to make git work
 	# The mount path inside the container is different from the host path. Hence, we over-mount
@@ -685,6 +699,14 @@ if [ -n "${KAS_GIT_CREDENTIAL_STORE}" ] ; then
 	set -- "$@" -v "$(realpath -e "${KAS_GIT_CREDENTIAL_STORE}")":/var/kas/userdata/.git-credentials:ro
 fi
 
+if [ -n "${KAS_GIT_CREDENTIAL_SOCKET}" ] ; then
+	if [ ! -S "${KAS_GIT_CREDENTIAL_SOCKET}" ]; then
+		fatal_error "passed KAS_GIT_CREDENTIAL_SOCKET '${KAS_GIT_CREDENTIAL_SOCKET}' is not a socket"
+	fi
+	KAS_GIT_CREDENTIAL_HELPER_DEFAULT="cache --socket=/var/kas/userdata/.git-cache-socket"
+	set -- "$@" -v "$(realpath -e "${KAS_GIT_CREDENTIAL_SOCKET}")":/var/kas/userdata/.git-cache-socket
+fi
+
 GIT_CREDENTIAL_HELPER="${GIT_CREDENTIAL_HELPER:-${KAS_GIT_CREDENTIAL_HELPER_DEFAULT}}"
 
 if [ -n "${GIT_CREDENTIAL_HELPER}" ] ; then
@@ -739,7 +761,7 @@ done
 
 # propagate only supported SHELL settings
 case "$SHELL" in
-/bin/sh|/bin/bash|/bin/dash)
+/bin/sh | /bin/bash | /bin/dash)
 	set -- "$@" -e "SHELL=$SHELL"
 	;;
 *)
@@ -757,7 +779,7 @@ fi
 
 # SC2086: Double quote to prevent globbing and word splitting.
 # shellcheck disable=2086
-set -- "$@" ${KAS_ISAR_ARGS} ${KAS_WITH_LOOP_DEV} ${KAS_RUNTIME_ARGS} \
+set -- "$@" ${KAS_ISAR_ARGS} ${KAS_RUNTIME_ARGS} ${KAS_EXTRA_RUNTIME_ARGS} \
     ${KAS_CONTAINER_IMAGE} ${KAS_OPTIONS_DIRECT} ${KAS_CMD} ${KAS_OPTIONS}
 if [ -n "${KAS_BITBAKE_C_OPTION_ARGS}" ]; then
 	set -- "$@" -c "${KAS_BITBAKE_C_OPTION_ARGS}"
-- 
2.53.0

[cip-dev][isar-cip-core][PATCH v2 2/5] update Isar to contain rootless changes

[Quirin Gylstorff]

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
 kas-cip.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kas-cip.yml b/kas-cip.yml
index 6badc7d..cbccf63 100644
--- a/kas-cip.yml
+++ b/kas-cip.yml
@@ -22,7 +22,7 @@ repos:
 
   isar:
     url: https://github.com/ilbers/isar.git
-    commit: 3c645ee8dcd3d2161b93a3b2f9808fe1829850e7
+    commit: ea319eb835aea545f23266ba15358bad029a56a0
     layers:
       meta:
 
-- 
2.53.0

Re: [cip-dev][isar-cip-core][PATCH v2 2/5] update Isar to contain rootless changes

[Jan Kiszka]

On 28.07.26 15:12, Quirin Gylstorff wrote:
> Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
> ---
>  kas-cip.yml | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kas-cip.yml b/kas-cip.yml
> index 6badc7d..cbccf63 100644
> --- a/kas-cip.yml
> +++ b/kas-cip.yml
> @@ -22,7 +22,7 @@ repos:
>  
>    isar:
>      url: https://github.com/ilbers/isar.git
> -    commit: 3c645ee8dcd3d2161b93a3b2f9808fe1829850e7
> +    commit: ea319eb835aea545f23266ba15358bad029a56a0
>      layers:
>        meta:
>  

I'm bumping this to 8ae7612dbc72607825e3efce6c3f8eef66200f2d because
several related fixes were merged meanwhile.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [cip-dev][isar-cip-core][PATCH v2 2/5] update Isar to contain rootless changes

[Jan Kiszka]

On 28.07.26 18:55, Jan Kiszka wrote:
> On 28.07.26 15:12, Quirin Gylstorff wrote:
>> Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
>> ---
>>  kas-cip.yml | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/kas-cip.yml b/kas-cip.yml
>> index 6badc7d..cbccf63 100644
>> --- a/kas-cip.yml
>> +++ b/kas-cip.yml
>> @@ -22,7 +22,7 @@ repos:
>>  
>>    isar:
>>      url: https://github.com/ilbers/isar.git
>> -    commit: 3c645ee8dcd3d2161b93a3b2f9808fe1829850e7
>> +    commit: ea319eb835aea545f23266ba15358bad029a56a0
>>      layers:
>>        meta:
>>  
> 
> I'm bumping this to 8ae7612dbc72607825e3efce6c3f8eef66200f2d because
> several related fixes were merged meanwhile.
> 

...which requires more changes to isar-cip-core. I'm using your patch
now and will send the second Isar update separately on top.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

[cip-dev][isar-cip-core][PATCH v2 3/5] use run_priviledged instead of sudo

[Quirin Gylstorff]

This is in preparation to support rootless builds

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
 classes-recipe/image_uuid.bbclass       | 4 ++--
 classes-recipe/read-only-rootfs.bbclass | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/classes-recipe/image_uuid.bbclass b/classes-recipe/image_uuid.bbclass
index 2cd8459..da54625 100644
--- a/classes-recipe/image_uuid.bbclass
+++ b/classes-recipe/image_uuid.bbclass
@@ -45,9 +45,9 @@ do_generate_image_uuid[vardeps] += "IMAGE_UUID"
 do_generate_image_uuid[dirs] = "${DEPLOY_DIR_IMAGE}"
 do_generate_image_uuid[network] = "${TASK_USE_SUDO}"
 do_generate_image_uuid() {
-    sudo sed -i '/^IMAGE_UUID=.*/d' '${IMAGE_ROOTFS}/etc/os-release'
+    run_privileged sed -i '/^IMAGE_UUID=.*/d' '${IMAGE_ROOTFS}/etc/os-release'
     echo "IMAGE_UUID=\"${IMAGE_UUID}\"" | \
-        sudo tee -a '${IMAGE_ROOTFS}/etc/os-release'
+        run_privileged tee -a '${IMAGE_ROOTFS}/etc/os-release'
 
     echo "TARGET_IMAGE_UUID=\"${IMAGE_UUID}\"" \
         > "${DEPLOY_DIR_IMAGE}/${IMAGE_FULLNAME}.uuid.env"
diff --git a/classes-recipe/read-only-rootfs.bbclass b/classes-recipe/read-only-rootfs.bbclass
index a67bb5f..1690ecb 100644
--- a/classes-recipe/read-only-rootfs.bbclass
+++ b/classes-recipe/read-only-rootfs.bbclass
@@ -44,15 +44,15 @@ IMMUTABLE_DATA_DIR ??= "/usr/share/immutable-data"
 
 copy_dpkg_state() {
     IMMUTABLE_VAR_LIB="${ROOTFSDIR}${IMMUTABLE_DATA_DIR}/var/lib"
-    sudo mkdir -p "$IMMUTABLE_VAR_LIB"
-    sudo cp -a ${ROOTFSDIR}/var/lib/dpkg "$IMMUTABLE_VAR_LIB/"
+    run_privileged mkdir -p "$IMMUTABLE_VAR_LIB"
+    run_privileged cp -a ${ROOTFSDIR}/var/lib/dpkg "$IMMUTABLE_VAR_LIB/"
 }
 
 ROOTFS_POSTPROCESS_COMMAND:append = " copy_home_to_immutable_data"
 ROOTFS_POSTPROCESS_COMMAND:remove:separate-home-part = " copy_home_to_immutable_data"
 copy_home_to_immutable_data() {
     IMMUTABLE_HOME_DIR="${ROOTFSDIR}${IMMUTABLE_DATA_DIR}"
-    sudo -s <<EOSUDO
+    run_privileged_heredoc <<EOSUDO
         set -e
         mkdir -p "$IMMUTABLE_HOME_DIR"
         rm -rf "$IMMUTABLE_HOME_DIR/home"
@@ -70,7 +70,7 @@ EROFS_EXCLUDE_DIRS = "${RO_ROOTFS_EXCLUDE_DIRS}"
 SQUASHFS_EXCLUDE_DIRS = "${RO_ROOTFS_EXCLUDE_DIRS}"
 
 image_configure_fstab() {
-    sudo tee '${IMAGE_ROOTFS}/etc/fstab' << EOF
+    run_privileged tee '${IMAGE_ROOTFS}/etc/fstab' << EOF
 # Begin /etc/fstab
 /dev/root	/		auto		defaults,ro			0	0
 LABEL=var	/var		auto		defaults			0	0
-- 
2.53.0

[cip-dev][isar-cip-core][PATCH v2 4/5] switch to isar-rootless

[Quirin Gylstorff]

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
 .reproducible-check-ci.yml | 3 +--
 Kconfig                    | 2 +-
 kas-cip.yml                | 2 +-
 3 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/.reproducible-check-ci.yml b/.reproducible-check-ci.yml
index fb24188..4f11b7d 100644
--- a/.reproducible-check-ci.yml
+++ b/.reproducible-check-ci.yml
@@ -37,8 +37,7 @@
     # Deploy .wic, .swu and wic partitions for build1
     - deploy_rb_artifacts build1
     # clean
-    - sudo rm -rf build/tmp
-    - sudo rm -rf build/sstate-cache
+    - kas purge --isar-rootless ${base_yaml}
     # Build 2nd time
     - !reference [.build_base, script]
     # Deploy .wic, .swu and wic partitions for build2
diff --git a/Kconfig b/Kconfig
index 5003bed..abf9aaf 100644
--- a/Kconfig
+++ b/Kconfig
@@ -17,7 +17,7 @@ config KAS_INCLUDE_MAIN
 
 config KAS_BUILD_SYSTEM
 	string
-	default "isar-privileged"
+	default "isar-rootless"
 
 config ARCH_AMD64
 	bool
diff --git a/kas-cip.yml b/kas-cip.yml
index cbccf63..eb26716 100644
--- a/kas-cip.yml
+++ b/kas-cip.yml
@@ -15,7 +15,7 @@ header:
 distro: cip-core-trixie
 target: cip-core-image
 
-build_system: isar-privileged
+build_system: isar-rootless
 
 repos:
   cip-core:
-- 
2.53.0

[cip-dev][isar-cip-core][PATCH v2 5/5] update README.md for rootless build

[Quirin Gylstorff]

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
 README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 435d037..df1564f 100644
--- a/README.md
+++ b/README.md
@@ -10,10 +10,10 @@ from scratch.
 
 ## Building Target Images
 
-Install docker or podman and make sure you have required permissions to start
-privileged containers. For docker, you need to be part of respective docker
-group (`sudo usermod -aG docker <USER>`). Privileged podman requires sudo
-rights for the caller (`<USER> ALL=(root) SETENV: /usr/bin/podman` in sudoers).
+Install docker or podman. For docker, you need to be part of respective docker
+group (`sudo usermod -aG docker <USER>`). The build requires Debian Bullseye
+(kernel version >= 5.10.1) or newer to support user namespaces for rootless builds.
+
 
 Open up the image configuration menu and select the desired target and its
 options:
-- 
2.53.0

Re: [cip-dev][isar-cip-core][PATCH v2 5/5] update README.md for rootless build

[Jan Kiszka]

On 28.07.26 15:12, Quirin Gylstorff wrote:
> Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
> ---
>  README.md | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/README.md b/README.md
> index 435d037..df1564f 100644
> --- a/README.md
> +++ b/README.md
> @@ -10,10 +10,10 @@ from scratch.
>  
>  ## Building Target Images
>  
> -Install docker or podman and make sure you have required permissions to start
> -privileged containers. For docker, you need to be part of respective docker
> -group (`sudo usermod -aG docker <USER>`). Privileged podman requires sudo
> -rights for the caller (`<USER> ALL=(root) SETENV: /usr/bin/podman` in sudoers).
> +Install docker or podman. For docker, you need to be part of respective docker
> +group (`sudo usermod -aG docker <USER>`). The build requires Debian Bullseye

...and docker will inherently remain not fully rootless (due to its
daemon concept). Therefore, we should strongly recommend podman here.

> +(kernel version >= 5.10.1) or newer to support user namespaces for rootless builds.

We need much fresher systems, already kernel ~6.7 for binfmt_misc
namespaces, at least when cross-building. Practically, I do not want to
debug ANY rootless build on anything older than trixie.

Jan

> +
>  
>  Open up the image configuration menu and select the desired target and its
>  options:

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [cip-dev][isar-cip-core][PATCH v2 5/5] update README.md for rootless build

[Quirin Gylstorff]

On 7/28/26 5:25 PM, Jan Kiszka wrote:
> On 28.07.26 15:12, Quirin Gylstorff wrote:
>> Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
>> ---
>>   README.md | 8 ++++----
>>   1 file changed, 4 insertions(+), 4 deletions(-)
>>
>> diff --git a/README.md b/README.md
>> index 435d037..df1564f 100644
>> --- a/README.md
>> +++ b/README.md
>> @@ -10,10 +10,10 @@ from scratch.
>>   
>>   ## Building Target Images
>>   
>> -Install docker or podman and make sure you have required permissions to start
>> -privileged containers. For docker, you need to be part of respective docker
>> -group (`sudo usermod -aG docker <USER>`). Privileged podman requires sudo
>> -rights for the caller (`<USER> ALL=(root) SETENV: /usr/bin/podman` in sudoers).
>> +Install docker or podman. For docker, you need to be part of respective docker
>> +group (`sudo usermod -aG docker <USER>`). The build requires Debian Bullseye
> 
> ...and docker will inherently remain not fully rootless (due to its
> daemon concept). Therefore, we should strongly recommend podman here.
> 
>> +(kernel version >= 5.10.1) or newer to support user namespaces for rootless builds.
> 
> We need much fresher systems, already kernel ~6.7 for binfmt_misc
> namespaces, at least when cross-building. Practically, I do not want to
> debug ANY rootless build on anything older than trixie.
> 
Proposal:
```
Install docker or podman. For docker, you need to be part of respective 
docker
group (`sudo usermod -aG docker <USER>`) as isar-cip-core uses 
isar-rootless and due
to its daemon concept docker cannot be fully rootless it is recommeneded 
to use podman. The build requires Debian Trixie (kernel version >= 6.7) 
or newer to support user and binfmt namespaces for rootless builds.
```

Quirin
> Jan
> 
>> +
>>   
>>   Open up the image configuration menu and select the desired target and its
>>   options:
> 

Re: [cip-dev][isar-cip-core][PATCH v2 5/5] update README.md for rootless build

[Jan Kiszka]

On 28.07.26 17:32, Quirin Gylstorff wrote:
> 
> 
> On 7/28/26 5:25 PM, Jan Kiszka wrote:
>> On 28.07.26 15:12, Quirin Gylstorff wrote:
>>> Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
>>> ---
>>>   README.md | 8 ++++----
>>>   1 file changed, 4 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/README.md b/README.md
>>> index 435d037..df1564f 100644
>>> --- a/README.md
>>> +++ b/README.md
>>> @@ -10,10 +10,10 @@ from scratch.
>>>     ## Building Target Images
>>>   -Install docker or podman and make sure you have required
>>> permissions to start
>>> -privileged containers. For docker, you need to be part of respective
>>> docker
>>> -group (`sudo usermod -aG docker <USER>`). Privileged podman requires
>>> sudo
>>> -rights for the caller (`<USER> ALL=(root) SETENV: /usr/bin/podman`
>>> in sudoers).
>>> +Install docker or podman. For docker, you need to be part of
>>> respective docker
>>> +group (`sudo usermod -aG docker <USER>`). The build requires Debian
>>> Bullseye
>>
>> ...and docker will inherently remain not fully rootless (due to its
>> daemon concept). Therefore, we should strongly recommend podman here.
>>
>>> +(kernel version >= 5.10.1) or newer to support user namespaces for
>>> rootless builds.
>>
>> We need much fresher systems, already kernel ~6.7 for binfmt_misc
>> namespaces, at least when cross-building. Practically, I do not want to
>> debug ANY rootless build on anything older than trixie.
>>
> Proposal:
> ```
> Install docker or podman. For docker, you need to be part of respective
> docker
> group (`sudo usermod -aG docker <USER>`) as isar-cip-core uses isar-
> rootless and due
> to its daemon concept docker cannot be fully rootless it is recommeneded
> to use podman. The build requires Debian Trixie (kernel version >= 6.7)
> or newer to support user and binfmt namespaces for rootless builds.
> ```
> 

I'm using now this:

Install docker or podman. For true unprivileged builds, podman is recommended.
For docker, you need to be part of respective docker group
(`sudo usermod -aG docker <USER>`). Rootless builds furthermore require a
host kernel version 6.7 or newer.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

Re: [cip-dev][isar-cip-core][PATCH v2 0/5] switch to rootless build

[Jan Kiszka]

On 28.07.26 15:12, Quirin Gylstorff wrote:
> This patchset contains the necessary changes to switch
> isar-cip-core to the new rootless build.
> 
> Changes v2:
>  - add Debian release requirement for rootless builds
>  - use kas purge in .reproducible-check-ci.yml
>  - use correct kas-container
> 
> Quirin Gylstorff (5):
>   update to kas 5.4
>   update Isar to contain rootless changes
>   use run_priviledged instead of sudo
>   switch to isar-rootless
>   update README.md for rootless build
> 
>  .gitlab-ci.yml                          |   2 +-
>  .reproducible-check-ci.yml              |   3 +-
>  Kconfig                                 |   2 +-
>  README.md                               |   8 +-
>  classes-recipe/image_uuid.bbclass       |   4 +-
>  classes-recipe/read-only-rootfs.bbclass |   8 +-
>  kas-cip.yml                             |   4 +-
>  kas-container                           | 300 +++++++++++++-----------
>  8 files changed, 176 insertions(+), 155 deletions(-)
> 

Thanks, merged with the mentioned changes.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center