Podman is a container manager not unlike Docker, but is daemon-less.
Similarly to docker-engine, quite a few kernel config options are
required; as they are very similar in goals and features, the options
from docker-engine have been duplicated for podman. As that was not
enough, a few additional options have been added after trial-and-error
testing (they are not explicitly listed in the documentation).
The documentation [0] states that seccomp can be disabled (i.e. not
enabled). However, without seccomp support, starting containers requires
--security-opt=seccomp=unconfined to be specified; it does not look
trivial to make that the default, though [1]. Furthermore, containers
are about security, so disabling a security measure does not sound too
good. So we make seccomp support mandatory.
Podman needs netavark as a the network backend (it missing is a hard
error at runtime). It is supposed to also require aardvark-dns, an
authoritative DNS resolver, but it missing does not look to adversely
affect networking, so it is not used (as not even packaged in Buildroot
yet).
Podman can run either as the root user, or it can run rootless, i.e. by
a non-root user, which requires a bit of setup (see below, in the
runtime test) and a few other dependencies: slirp4netns [2] (to provide
network connectivity in userland), and support for subordinate UIDs and
GIDs with the shadow library. Rootless mode is one of the main selling
point for podman, so we decided that this would not be configurable in
Buildroot.
Similar to Docker, podman can inject a minimalist init as PID1 in
containers, and like Docker, this is optional; podman however by default
uses catatonit as such an init [3]. As for Docker-engine, we offer a
choice of which init package to use to provide podman-init.
Podman requires at least three config files; they can be either per-user
or system-wide:
- containers.conf [4]: defines various settings for the container
runtimes;
- policy.json [5]: defines what signature to accept to validate
images; without one such file, podman just refuses to pull images;
- registries.conf [6]: defines where to pull images from; without it,
podman does not know how to pull un-qualified images (i.e. images
where the registry is not specified in the path, and which Docker
would fetch from the Docker Hub, e.g. "busybox:latest").
For those three files, we provide a very minimal default that (in the
same order as above):
- uses the slirp4netns network backend for rootless operation (the
default in podman is to use pasta [1], so we need to explicitly
configure it to use slirp4netns);
- allows pulling images which signature can't be verified;
- pulls unqualified images from the Docker Hub, as is traditional.
Providing actual files is going to be use-case dependent, and interested
parties will have to provide their own config files, e.g. in a rootfs
overlay.
Finally, we add a runtime test for podman. Podman is a huge binary, and
may call other huge binaries (netavark...); this can be quite slow in
the emulated machine (even when running on a very fast host machine), so
we use a huge timeout for all commands involving podman, even those that
exit the containers, as that may need to tear down podman setup.
The default kernel used in runtime tests is missing a lot of features,
so we need to build our own; we use the same version as the bundled
kernel. We can't use cpio either, because we need a filesystem that can
be used as a lower and upper of overlayfs, which is not possible with
the filesystem the cpio is extracted into; ext2 fits the bill, so we use
that. We need a bit of space to store images and stuff, so let's be
generous and allocate 256M.
To test rootless operation, we need a non-root user that has some
special setup [7]; it is easier to run the commands from the infra
rather than carry a user-definition table and a rootfs overlay. We need
that user to have the same prompts (main and continuation) so that the
REPLWrapper still detects those; it has the unfortunate side effect that
it is not immediately obvious whether a command was run as root or not,
and one has to look back up in the run-log to see whether there was a
transition to another user earlier.
Still for rootless containers, podman/netavark expect /etc/resolv.conf
to be either a plain file, or a symlink that points either deeper in
/etc or anywhere in /run; if resolv.conf resolves to any other location,
DNS in rootless containers does not work. This is reasonable, and is
what already happens on a systemd-based system (and thus all major
distributions nowadays. However, in Buildroot, we put the actual file in
/tmp; this is historical, and dates back to the days where Buildroot did
not have a guaranteed-writable /run. So, we work around this limitation
in the test (for now).
The official busybox image on the Docker Hub supports a lot of
architectures, of which armv7 which we use for this runtime test.
Finding a small image that also supports armv7 on other registries was
a bit of a challenge; we eventually found one busybox image on quay.io,
but it is not an official busybox image; still, it fits the bill, so we
use it.
There is no runtime test with systemd, as this requires quite some
additional setup that does not look very trivial to do; when it detects
it is running under systemd in rootless mode, podman expects that a full
user session exists, or it whines about it every time it is started,
reverting to non-systemd behaviour; getting a full user session does not
look to be that trivial (PAM?), so this would not exercise the actual
integration with systemd, so the test would not be meaningful, so it is
not provided. This is left as an exercise to an interested party to
extend the tests.
PS: Hat-tip to Raphael, who provided some pointers and hints on this
change, especially for rootless mode. Thanks! 👍
[0] https://podman.io/docs/installation#get-source-code
[1] it looks like we can provide a custom seccomp profile, by specifying
seccomp_profile="PATH" in containers.conf; that would still require
seccomp support to use that file, though, so that does not change the
outcome.
[2] it is possible to use another backend, but it is not packaged in
in Buildroot yet: https://passt.top/passt/about/#pasta-pack-a-subtle-tap-abstraction
[3] podman expects a 'catatonit' helper in /usr/libexec/podman, so even
if tini would be usable instead, it would not feel right to use it to
impersonate catatonit. So let's assume that only catatonit is supported.
[4] https://github.com/containers/common/blob/main/docs/containers.conf.5.md
[5] https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md
[6] https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md
[7] https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Cc: Christian Stewart <christian@aperture.us>
Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Currently, nftables JSON support is implicit: if jansson is enabled,
JSON support is enabled, otherwise it is not.
Some packages will require that nftables be built with JSON support;
that's the case of netavarks, for example (to come in a later patch).
So, in the current state, it would mean a package would have to select
jansson, although it does not itself use it, so that nftables has JSON
support. This does not feel right.
Instead, introduce an option to nftables, to explicitly enabled JSON
support. Packages such as netavark would then just have to require JSON
support in nftables.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Currently, the cgroupfs-mount package only mounts a cgroup v1 hierarchy,
but v1 is considered legacy and obsolete, while v2 has been around for a
while now, and is required by some packages (e.g. podman whines about
v1).
cgroupfs-mount has not had a release in almost 8 years now, and only the
occasional commit since then and until more than 3 years ago. It's not
going to evolve...
Add a new package with a simple-enough sysv startup script, that mounts
the cgroup v2 hierarchy filesystem. For systemd, there's nothing to do,
as systemd handles the mount by itself.
Since both cgroup v1 and v2 use the same mountpoint, we can't have both
enabled at the same time, and thus we restrict the v2 to be hidden when
v1 is enabled (quite a few packages select the v1; changing those would
require that they be validated against v2 first...)
Note that, due to limitations in Kconfig, cgroupfs-v2-mount will appear
indented below cgroupfs-mount, because it has a (negative) dependency on
it. This spurious indentation is unfortunate and annoying, but benign;
fixing that would require breaking the dependency with a random Kconfig
symbol, which we don't have, and which we decided not to introduce just
for this one use-case (well, there's host-gnupg and host-gnupg2 that
have the exact same issue, but meh...)
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Fiona Klute <fiona.klute@gmx.de>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
When it was introduced in 2016 with commit 0e1547a87c (cgroupfs-mount:
new package), we did not yet have the infrastructure for package to set
kernel config options, which only came 4 years later with commit
0aed4c2dae (linux: allow packages to set kernel config options).
So at that time, the requirements for cgroupfs-mount were documented in
the help for the Kconfig symbol.
But now that we do have the infrastructure in place, actually use it to
set the required options, and drop the list from the Kconfig entry (that
would be duplication, prone to bit-rot with time, and other packages do
not document their requirements in Kconfig, they just use the infra to
set the options).
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Skopeo can be used to manipulate container images, and so can be useful
on target devices that are going to be used as a host to run containers.
So, add a target variant for skopeo.
... with a runtime test while at it.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Christian Stewart <christian@aperture.us>
Cc: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
When it detects it runs under systemd, conmon will want to log to the
journal. However, it needs to be linked with libsystemd to do so and if
not, will error out:
Feb 22 11:10:03 buildroot conmon[199]: conmon 3b462ce6f2cc64f75c42 <error>: Include journald in compilation path to log to systemd journal
This prevents starting any container.
Add a dependency to systemd when it is enabled.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
When the subids feature is enabled, shadow will install a library and a
header:
$ sort output/build/shadow-4.16.0/.files-list.txt
[...]
shadow,./lib/libsubid.la
shadow,./lib/libsubid.so
shadow,./lib/libsubid.so.5
shadow,./lib/libsubid.so.5.0.0
[...]
shadow,./usr/include/shadow/subid.h
[...]
Install to staging in that case.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Reviewed-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
When time comes to check certificates, the date and time in the emulated
machine should be close enough to the actual values, so that certificate
validity can be checked.
Some Qemu machines have an RTC (e.g. arm vexpress-a9 has a pl031), and
the kernel needs a driver for those RTC. It is not guaranteed that the
machine used for a test meets those two conditions; in such a case, the
time in the machine starts way back in the past (1970-01-01T00:00:00Z on
sysv, or the release date of systemd). This is the case with the default
kernel, so such tests do not have the proper time.
Set the date to the date of the host system. This is going to be accurate
to the second, which is, by far, enough for our purpose.
To avoid having to consider what combination of emulated machine and kernel
configuration are being used, we always set the date, as this is a
generic step that should be done by the infra (like login in as root is).
The Emulator() class doesn't inherit from unittest.TestCase, so we can't
call any of the usual self.assertXXX() methods; instead, we just raise
a standard exception, like is done a few lines above to detect the login
prompt.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Ricardo Martincoski <ricardo.martincoski@datacom.com.br>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Like the existing tini, catatonit can be used as minimal init to be
used as PID-1.
Add it to the list of init systems, like was done for tini in
24cac9c4e6 (system: add tini as init system) and tinyinit in
c1daa35cd9 (package/tinyinit: new package).
Unlike the "main" init systems, there is no historical preference for
those minimalist init systems, so just keep them alphabetically
ordered.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
currently, docker-engine can only use tini as injected init. catatonit
as a package exists, but it does not create the symlink that would be
needed at runtime [0].
Add a choice at the docker-engine level, for which injected init to use,
bringing catatonit to the integration level of tini.
[0] that could be done in a post-build script, but that's not practical.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Christian Stewart <christian@aperture.us>
Cc: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Tested-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
[Julien: move the legacy option to a new 2025.05 section]
Signed-off-by: Julien Olivain <ju.o@free.fr>
tini can be used standalone, not just as an init injected by docker.
As such, creating the docker-engine's init symlink does not belong to
tini itself, but to docker-engine.
This will also help later, when we allow docker-engine to use another
init alternative, catatonit (already paclkaged in Buildroot, but not
integrated with docker).
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Christian Stewart <christian@aperture.us>
Cc: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Tested-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
- Updated Linux, U-Boot, and TF-A to lf-6.6.52-2.2.0 tag.
- Updated readme.txt
Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
[Julien: remove fmc and fmlib in readme.txt to reflect
comment from Brandon Maier]
Signed-off-by: Julien Olivain <ju.o@free.fr>
- The license file was renamed from COPYING to LICENSE.
- Added a patch to fix build errors with gcc-14.
Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
Reviewed-by: Brandon Maier <brandon.maier@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The package is unchanged; a new tag was added to match other NXP QorIQ package versions.
Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
Reviewed-by: Brandon Maier <brandon.maier@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Remove patches that are now included in upstream release.
Package switched from autotools to cmake based build.
Backport two build fixes that are already merged upstream.
* 0001-Include-time.h-for-timespec-struct-definition.patch fixes a musl
build issue
* 0002-CMakeLists.txt-add-an-option-to-control-shared-libra.patch fixes
static only builds
Release Notes: https://github.com/linux-can/can-utils/releases/tag/v2025.01
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changelog:
2025-01-04 Jess Thrysoee
* all: sync with upstream source
2024-08-08 Jess Thrysoee
* all: sync with upstream source
* doc/Makefile.am: fix regression. Name all manpage links as el_*
(e.g. el_history.3) to avoid conflicts.
Reported by Zopolis4
2024-05-17 Jess Thrysoee
* all: sync with upstream source
Upstream changes are theoretically viewable at [1] but not
in a very readable form.
[1] http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libedit
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add support for the LicheePi 4A with mainline component:
- Linux Kernel 6.12
The following components are provided by vendor:
- U-Boot 2020.01
- OpenSBI v0.9
Board homepage and more usable wiki:
- https://wiki.sipeed.com/hardware/en/lichee/th1520/lpi4a/1_intro.html
th1520-boot-firmware is selected from the package sipeed-lpi4abin.
This is inspired from lone0's fork of buildroot for th1520.[1]
[1] https://github.com/lone0/buildroot-th1520
Signed-off-by: Kanak Shilledar <kanakshilledar@gmail.com>
[Julien: Tested on cpu board version 51601
on base board version 51602]
Tested-by: Julien Olivain <ju.o@free.fr>
[Julien:
- add Signed-off-by line in commit log
- reorder defconfig entries with "make savedefconfig"
- fixed post-image.sh shellcheck warnings
(found with "make check-package")
- add extra info in readme.txt
- change linux-headers.hash to a symlink
- change linux.hash comment to take hash from upstream
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Sipeed LicheePi 4A requires some proprietary binaries
for booting, these are provided in the th1520-boot-firmware
repo [1]. These binaries are also required for the onboard
sound and wifi.
[1] https://github.com/revyos/th1520-boot-firmware
Signed-off-by: Kanak Shilledar <kanakshilledar@gmail.com>
[Julien:
- add Signed-off-by line in commit log
- reindent SIPEED_LPI4ABIN_FILES with 1 tab
- fix DEVELOPERS entry (remove extra 's')
- add upstream url in Config.in
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
- Update syslogd -T documentation, it applies to messages originating
both locally and from remote syslog servers
- Fix hostname filtering support, introduced in v2.7.0, broken
- Fix parsing of userspace messages in /dev/kmsg, inserted an
extra space before the message payload
From https://github.com/troglobit/sysklogd/releases/tag/v2.7.1
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Note: configs/freescale_imx6{dl,q,sx}* corresponds to the five:
freescale_imx6dlsabreauto_defconfig
freescale_imx6dlsabresd_defconfig
freescale_imx6qsabreauto_defconfig
freescale_imx6qsabresd_defconfig
freescale_imx6sxsabresd_defconfig
Those i.MX6 Sabre defconfigs have a lot in common. This is why they are
all updated at once in this single commit.
This commit bumps U-Boot and Linux kernel to the NXP BSP
lf-6.6.52-2.2.0 versions
Signed-off-by: Gilles Talis <gilles.talis@gmail.com>
Tested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump U-Boot and Linux kernel to the NXP BSP lf-6.6.52-2.2.0 versions.
Signed-off-by: Gilles Talis <gilles.talis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump U-Boot and Linux kernel to the NXP BSP lf-6.6.52-2.2.0 versions.
Signed-off-by: Gilles Talis <gilles.talis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump ATF, U-Boot and Linux kernel to the NXP BSP lf-6.6.52-2.2.0
versions.
Signed-off-by: Gilles Talis <gilles.talis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump ATF, U-Boot and Linux kernel to the NXP BSP lf-6.6.52-2.2.0
versions.
Signed-off-by: Gilles Talis <gilles.talis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump ATF, U-Boot and Linux kernel to the NXP BSP lf-6.6.52-2.2.0
versions.
Signed-off-by: Gilles Talis <gilles.talis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
