mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 16:01:54 -09:00
master
5 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Romain Naour
|
13a0129b0a |
support/testing: use larger runner to reduce the CI minute consumed per pipeline
Based on the first pipeline result [1], use larger runner for the following tests: tests.fs.test_oci.TestOci.test_run (01:08:15) saas-linux-small-amd64 -> saas-linux-xlarge-amd64 tests.package.test_dpdk.TestDPDK.test_run (01:08:36) saas-linux-small-amd64 -> saas-linux-xlarge-amd64 tests.package.test_z3.TestZ3.test_run (01:11:41) saas-linux-small-amd64 -> saas-linux-xlarge-amd64 tests.package.test_octave.TestOctave.test_run (01:21:57) saas-linux-small-amd64 -> saas-linux-xlarge-amd64 tests.package.test_podman.TestPodmanSlirpNftables.test_run (01:21:15) saas-linux-small-amd64 -> saas-linux-xlarge-amd64 tests.package.test_podman.TestPodmanSlirpIptables.test_run (01:21:25) saas-linux-small-amd64 -> saas-linux-xlarge-amd64 tests.package.test_mariadb.TestMariaDB.test_run (01:26:15) saas-linux-small-amd64 -> saas-linux-xlarge-amd64 tests.package.test_podman.TestPodmanIptables.test_run (01:28:51) saas-linux-small-amd64 -> saas-linux-xlarge-amd64 tests.package.test_podman.TestPodmanTini.test_run (01:29:08) saas-linux-small-amd64 -> saas-linux-xlarge-amd64 tests.package.test_podman.TestPodmanNftables.test_run (01:41:26) saas-linux-small-amd64 -> saas-linux-xlarge-amd64 tests.package.test_weston.TestWeston.test_run (01:26:17) saas-linux-large-amd64 -> saas-linux-2xlarge-amd64 tests.package.test_python_pyqt5.TestPythonPyQt5.test_run (01:41:33) saas-linux-large-amd64 -> saas-linux-2xlarge-amd64 tests.package.test_nodejs.TestNodeJSModuleHostBin.test_run (01:21:06) saas-linux-large-amd64 -> saas-linux-2xlarge-amd64 tests.package.test_flutter.TestFlutter.test_run (01:03:05) saas-linux-xlarge-amd64 -> saas-linux-2xlarge-amd64 For tests long that already use 2xlarge runner tag, we may have to run them on Gitlab runners owned by the Buildroot project. [1] https://gitlab.com/buildroot.org/buildroot/-/pipelines/2562421098 Signed-off-by: Romain Naour <romain.naour@smile.fr> Signed-off-by: Arnout Vandecappelle <arnout@rnout.be> |
||
|
Yann E. MORIN
|
3a2baca4b7 |
system/skeleton: move target of /etc/resolv.conf symlink
In commit |
||
|
Yann E. MORIN
|
54f79d804f |
package/podman: add option to use passt as network backend
passt/pasta is the officially supported network backend, with slirp4netns only considered a legacy solution. However, some people have experienced corner cases when using passt/pasta (as it still is a young stack), so we do not want to do a blanket replace of slirp4netns just yet. Still, we make passt/pasta the default option. As a consequence, the existing runtime tests will now test passt/pasta, so we introduce two new tests for slirp4netns as a network backend. Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Signed-off-by: Julien Olivain <ju.o@free.fr> |
||
|
Yann E. MORIN
|
b36475315b |
package/aardvark-dns: new package
aardvark-dns is needed by netavark to provide cross-container DNS resolving with Podman. It is to be noted that netavark and aardvark-dns have to be updated in lock-step [0]. Update the podman runtime test to validate this is working. [0] https://github.com/containers/podman/blob/main/DISTRO_PACKAGE.md#networking-tools-netavark-aardvark-dns-passt Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Signed-off-by: Julien Olivain <ju.o@free.fr> |
||
|
Yann E. MORIN
|
ebbaac08e3 |
package/podman: new package
Podman is a container manager not unlike Docker, but is daemon-less.
Similarly to docker-engine, quite a few kernel config options are
required; as they are very similar in goals and features, the options
from docker-engine have been duplicated for podman. As that was not
enough, a few additional options have been added after trial-and-error
testing (they are not explicitly listed in the documentation).
The documentation [0] states that seccomp can be disabled (i.e. not
enabled). However, without seccomp support, starting containers requires
--security-opt=seccomp=unconfined to be specified; it does not look
trivial to make that the default, though [1]. Furthermore, containers
are about security, so disabling a security measure does not sound too
good. So we make seccomp support mandatory.
Podman needs netavark as a the network backend (it missing is a hard
error at runtime). It is supposed to also require aardvark-dns, an
authoritative DNS resolver, but it missing does not look to adversely
affect networking, so it is not used (as not even packaged in Buildroot
yet).
Podman can run either as the root user, or it can run rootless, i.e. by
a non-root user, which requires a bit of setup (see below, in the
runtime test) and a few other dependencies: slirp4netns [2] (to provide
network connectivity in userland), and support for subordinate UIDs and
GIDs with the shadow library. Rootless mode is one of the main selling
point for podman, so we decided that this would not be configurable in
Buildroot.
Similar to Docker, podman can inject a minimalist init as PID1 in
containers, and like Docker, this is optional; podman however by default
uses catatonit as such an init [3]. As for Docker-engine, we offer a
choice of which init package to use to provide podman-init.
Podman requires at least three config files; they can be either per-user
or system-wide:
- containers.conf [4]: defines various settings for the container
runtimes;
- policy.json [5]: defines what signature to accept to validate
images; without one such file, podman just refuses to pull images;
- registries.conf [6]: defines where to pull images from; without it,
podman does not know how to pull un-qualified images (i.e. images
where the registry is not specified in the path, and which Docker
would fetch from the Docker Hub, e.g. "busybox:latest").
For those three files, we provide a very minimal default that (in the
same order as above):
- uses the slirp4netns network backend for rootless operation (the
default in podman is to use pasta [1], so we need to explicitly
configure it to use slirp4netns);
- allows pulling images which signature can't be verified;
- pulls unqualified images from the Docker Hub, as is traditional.
Providing actual files is going to be use-case dependent, and interested
parties will have to provide their own config files, e.g. in a rootfs
overlay.
Finally, we add a runtime test for podman. Podman is a huge binary, and
may call other huge binaries (netavark...); this can be quite slow in
the emulated machine (even when running on a very fast host machine), so
we use a huge timeout for all commands involving podman, even those that
exit the containers, as that may need to tear down podman setup.
The default kernel used in runtime tests is missing a lot of features,
so we need to build our own; we use the same version as the bundled
kernel. We can't use cpio either, because we need a filesystem that can
be used as a lower and upper of overlayfs, which is not possible with
the filesystem the cpio is extracted into; ext2 fits the bill, so we use
that. We need a bit of space to store images and stuff, so let's be
generous and allocate 256M.
To test rootless operation, we need a non-root user that has some
special setup [7]; it is easier to run the commands from the infra
rather than carry a user-definition table and a rootfs overlay. We need
that user to have the same prompts (main and continuation) so that the
REPLWrapper still detects those; it has the unfortunate side effect that
it is not immediately obvious whether a command was run as root or not,
and one has to look back up in the run-log to see whether there was a
transition to another user earlier.
Still for rootless containers, podman/netavark expect /etc/resolv.conf
to be either a plain file, or a symlink that points either deeper in
/etc or anywhere in /run; if resolv.conf resolves to any other location,
DNS in rootless containers does not work. This is reasonable, and is
what already happens on a systemd-based system (and thus all major
distributions nowadays. However, in Buildroot, we put the actual file in
/tmp; this is historical, and dates back to the days where Buildroot did
not have a guaranteed-writable /run. So, we work around this limitation
in the test (for now).
The official busybox image on the Docker Hub supports a lot of
architectures, of which armv7 which we use for this runtime test.
Finding a small image that also supports armv7 on other registries was
a bit of a challenge; we eventually found one busybox image on quay.io,
but it is not an official busybox image; still, it fits the bill, so we
use it.
There is no runtime test with systemd, as this requires quite some
additional setup that does not look very trivial to do; when it detects
it is running under systemd in rootless mode, podman expects that a full
user session exists, or it whines about it every time it is started,
reverting to non-systemd behaviour; getting a full user session does not
look to be that trivial (PAM?), so this would not exercise the actual
integration with systemd, so the test would not be meaningful, so it is
not provided. This is left as an exercise to an interested party to
extend the tests.
PS: Hat-tip to Raphael, who provided some pointers and hints on this
change, especially for rootless mode. Thanks! 👍
[0] https://podman.io/docs/installation#get-source-code
[1] it looks like we can provide a custom seccomp profile, by specifying
seccomp_profile="PATH" in containers.conf; that would still require
seccomp support to use that file, though, so that does not change the
outcome.
[2] it is possible to use another backend, but it is not packaged in
in Buildroot yet: https://passt.top/passt/about/#pasta-pack-a-subtle-tap-abstraction
[3] podman expects a 'catatonit' helper in /usr/libexec/podman, so even
if tini would be usable instead, it would not feel right to use it to
impersonate catatonit. So let's assume that only catatonit is supported.
[4] https://github.com/containers/common/blob/main/docs/containers.conf.5.md
[5] https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md
[6] https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md
[7] https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Cc: Christian Stewart <christian@aperture.us>
Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
|