[PATCH v2 00/13] Container Improvements

[Tim Orling <ticotimo@gmail.com>]

This series:
  * Sets OCI_IMAGE_RUNTIME_UID with ??= weak assignment in
    image-oci to allow container-nonroot-user to set a different
    default
  * Adds a class to create/run containers with a non-root user
  * Adds a class to create non-volatile var log and tmp directories
  * Adds a class to enable 'dev' mode where the container starts as
    the root user
  * Adds new containers:
    - app-container-python
    - app-containter-mosquitto
    - app-container-valkey
    - app-container-nginx
  * Modifies app-container-curl to be more like the upstream
    experience (and more like the above containers)
  * Allows mosquitto and libwebsockets to be parsed for
    vcontainer distro so we can build multiarch containers
    for app-container-mosquitto.
  * Allows meta-webserver/recipes-httpd/nginx to be parsed for
    vcontainer distro so we can build multiarch containers
    for app-container-nginx.
  * Adds a fix for buildbot-venv shadowing for environment-setup-ci
    script

The resulting containers were tested with simple command line
usage compared to Docker provided equivalents to ensure the
same expected behavior.

Changes in v2:

  There were a fair number of changes in v2 in reponse to review
  comments and observations during testing.

  * image-oci.bbclass:
    - set OCI_IMAGE_RUNTIME_UID with ??= to allow other classes
      to override
  * container-nonroot-user.bbclass:
    - set EXTRA_USERS_PARAMS with +=
    - added comments to clarify the PYEOF Python heredoc behavior
    - added logic to detect $image_name/index.json and fail if not
      found
  * container-volatile-fixup.bbclass: avoid repeating the same
    rootfs postfunc by adding a helper class
  * container-dev-mode.bbclass: avoid repeating the same logic
    to run container as root user in '-dev' mode
  * app-container-python (and other container image recipes):
    - drop now redundant IMAGE_INSTALL lines
    - simplify by inheriting container-volatile-fixup
    - inherit container-dev-mode
  * app-container-mosquitto:
    - verify '-dev' mode switches from root user to mosquitto user
    - verify "production" mode runs as 'nonroot' user
    - fix bbmask to allow mosquitto and required libwebsockets
  * app-container-valkey:
    - added tini and container-entrypoint.sh, like upstream containers
  * app-container-nginx:
    - fixup 'nonroot' user ownership of NONROOT_OWNED_DIRS
    - fix bbmask to allow nginx (but not other recipes-httpd)
  * fix for older distro hosts where the 'websockets' Python library is
    not new enough (>10.0) and on the AutoBuilder needs to use 'buildtools'.
    The PATH in environment-setup-ci now plays properly with such a set up
    by no longer added /usr/bin and /bin before existing $PATH.

Successful build https://autobuilder.yoctoproject.org/valkyrie/#/builders/117/builds/25

Tim Orling (13):
  image-oci: set OCI_IMAGE_RUNTIME_UID with ??=
  classes: add container-nonroot-user.bbclass
  classes: add container-volatile-fixup.bbclass
  classes: add container-dev-mode.bbclass
  recipes-containers/images: add app-container-python
  recipes-containers/images: add app-container-mosquitto
  vcontainer-bbmask.inc: allow 'mosquitto', 'libwebsockets'
  recipes-containers/images: add app-container-valkey
  recipes-containers/images: add app-container-nginx
  vcontainer-bbmask.inc: allow meta-webserver/recipes-httpd/nginx
  app-container-curl: use multilayer mode; container-nonroot-user
  container-image-multiarch: add helper recipe
  vcontainer-tarball: fix buildbot-venv shadowing

 classes/container-dev-mode.bbclass            |  34 ++++
 classes/container-nonroot-user.bbclass        | 155 ++++++++++++++++++
 classes/container-volatile-fixup.bbclass      |   6 +
 classes/image-oci.bbclass                     |   3 +-
 conf/distro/include/vcontainer-bbmask.inc     |   6 +-
 conf/layer.conf                               |   1 +
 .../images/app-container-curl.bb              |  39 +++++
 .../images/app-container-mosquitto.bb         |  43 +++++
 .../images/app-container-nginx.bb             |  62 +++++++
 .../images/app-container-python.bb            |  45 +++++
 .../images/app-container-valkey.bb            |  71 ++++++++
 .../container-entrypoint.sh                   |  18 ++
 .../images/container-image-multiarch.bb       |  31 ++++
 .../vcontainer/vcontainer-tarball.bb          |   4 +-
 recipes-demo/images/app-container-curl.bb     |  46 ------
 15 files changed, 512 insertions(+), 52 deletions(-)
 create mode 100644 classes/container-dev-mode.bbclass
 create mode 100644 classes/container-nonroot-user.bbclass
 create mode 100644 classes/container-volatile-fixup.bbclass
 create mode 100644 recipes-containers/images/app-container-curl.bb
 create mode 100644 recipes-containers/images/app-container-mosquitto.bb
 create mode 100644 recipes-containers/images/app-container-nginx.bb
 create mode 100644 recipes-containers/images/app-container-python.bb
 create mode 100644 recipes-containers/images/app-container-valkey.bb
 create mode 100644 recipes-containers/images/app-container-valkey/container-entrypoint.sh
 create mode 100644 recipes-containers/images/container-image-multiarch.bb
 delete mode 100644 recipes-demo/images/app-container-curl.bb

This series can be found at 
https://github.com/moto-timo/meta-virtualization/tree/container-improvements-v2

-- 
2.54.0