Re: [meta-virtualization][PATCH] Add Eclipse Ankaios container orchestrator recipe

[Bruce Ashfield <bruce.ashfield@gmail.com>]

Hi Kaloyan,

Thanks for the Ankaios recipe. Reviewed against the meta-virt layer
conventions and against what we generally ask for when a new orchestrator
lands. Overall content is good: sensible package split (ank / ank-agent /
ank-server + meta), correct FILES/CONFFILES gating on the systemd vs
sysvinit DISTRO_FEATURES, LIC_FILES_CHKSUM points at the in-source
LICENSE (not a template), SRCREV pinned to the v1.0.1 tag. No blocking
issues on the mechanics.

There are three structural asks and a handful of polish notes below.

Structural — please address in a v2
-----------------------------------

1. Missing COMPATIBLE_HOST and no container-runtime coupling in RDEPENDS

   Convention in the layer for anything that orchestrates containers:
   set COMPATIBLE_HOST to exclude architectures we can't build for
   (the k3s/cri-o pattern is "^(?!(qemu)?mips).*"), and RDEPEND on
   the actual runtime the agent invokes. Right now the meta-package
   ships binaries with no runtime, so `apt install ankaios` on the
   target gives you the tools but no way to start a workload.

   Ankaios' upstream docs mention podman + Kata Containers as the
   supported runtimes. Which one the recipe should require (or
   RRECOMMEND) is a decision for the recipe. Whichever you pick will
   also bring the seccomp DISTRO_FEATURE requirement transitively —
   Ankaios itself doesn't use seccomp (nothing in the 740-crate list
   references libseccomp/seccompiler/apparmor), so there's no need to
   set REQUIRED_DISTRO_FEATURES = "seccomp" on ankaios directly.

2. Testability in QEMU — required for maintenance in this layer

   For meta-virt to accept and maintain a new recipe, we need to be
   able to boot it in QEMU and exercise the primary use case
   end-to-end. Not a synthetic build-only test. Something like the
   crosvm-image-minimal + README-crosvm.md pattern we merged recently:

     * A minimal image recipe that lands ankaios + the chosen runtime
       + a small default state.yaml exercising a hello-world workload
     * A README alongside the recipe describing the QEMU boot invocation,
       the expected `ank get workloads` output, and how to tear down.
     * MACHINE = "qemux86-64" as the reference target.

   The current recipe is a component-only recipe with no test image
   and no how-to-boot documentation. We can't accept that as-is
   because the moment upstream breaks something we won't have a
   reproducer.

3. License audit for the 740 vendored crates

   The recipe declares LICENSE = "Apache-2.0" — that's the upstream
   Ankaios project's own license, but with 740 vendored Rust crates
   the actual license mix is almost certainly wider (MIT/BSD/ISC
   commonly show up in the Rust ecosystem). Please run a real audit
   this round rather than deferring — one of:

     * `cargo license` or `cargo-deny` against the Cargo.lock,
       aggregate the SPDX identifiers, expand LICENSE to the union.
     * Or the `oe-go-mod-fetcher` license-scan machinery we use for
       Go recipes has a Rust-side equivalent; check if any of your
       tooling can consume Cargo.lock.

   I've been sweeping this cleanup across the layer's other Rust
   recipes (crosvm, netavark, aardvark-dns, podlet, fuse-overlayfs)
   as a follow-up, but it's easier for you to do it once upfront than
   for us to do it later without knowledge of the vendored graph.

Polish (fold into v2 or address per your judgment)
--------------------------------------------------

  * `SECTION = "base"` is unusual for an orchestrator — other recipes
    in the layer use `console/utils`, `virtualization/tools`, or
    leave it unset.

  * Recipe comment says "Add cargo-update-recipe-crates to generate
    the crates.inc file automatically" but the inherit line only has
    `cargo systemd update-rc.d`. Add cargo-update-recipe-crates so
    `bitbake -c update_crates ankaios` works for future maintenance.

  * Systemd units are minimalist: no reference to the /etc/ankaios/
    config file that the recipe installs, no Restart=on-failure. If
    ank-server/ank-agent default to reading /etc/ankaios/*.conf, the
    unit should either ExecStart with the path or you should confirm
    the default location matches. Otherwise the config file is
    orphaned.

  * SYSTEMD_AUTO_ENABLE = "enable" is global to the recipe. Cleaner
    per-package (SYSTEMD_AUTO_ENABLE:ank-server = "enable", etc.) so
    a downstream can toggle one without the other.

  * The sysvinit scripts source /etc/default/${NAME} but no template
    is installed. A one-line stub with RUST_LOG=info commented out
    would spare users from having to create the file from scratch.

I'll hold the recipe until v2 with the structural items addressed.
Happy to review a v2 when you send it.

Bruce