docker: support qemu target builds #1092

tormath1 · 2023-03-03T14:29:36Z

this commit adds qemu amd64 binaries to build qemu images from the Docker image.

example:

docker run -it --net host --rm -e OEM_ID=openstack cluster-node-image-builder-amd64 build-qemu-flatcar

Note: For now it can only run builds without acceleration because it still uses the imagebuilder user but as imagebuilder needs to be in the KVM group and we don't know in advance the group ID of kvm group on the host: we would need to build and run the image with root user to allow KVM acceleration, this can be done in a follow-up PR.

Additional context

We could preserve the imagebuilder user by creating it with the uid/gid 0 but in the end it's creating another "root" user...

k8s-ci-robot · 2023-03-03T14:29:45Z

Hi @tormath1. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

mboersma · 2023-03-03T16:38:32Z

images/capi/Dockerfile

    && apt-get purge --auto-remove -y \
    && rm -rf /var/lib/apt/lists/*

 ARG ARCH
 ARG PASSED_IB_VERSION

-USER imagebuilder


I would also like to use the default root user, because we want to use this container image in our pipelines and that's an Azure DevOps requirement. (See #991.)

But using a specific non-root user in a Docker container is still generally considered a "best practice" I believe, so I'd like to hear from others as to whether this change is acceptable.

But using a specific non-root user in a Docker container is still generally considered a "best practice" I believe, so I'd like to hear from others as to whether this change is acceptable.

That was my conclusion too - as I don't see any other indications to use a non-root user. 🤷 Let's hear from the maintainers!

Can we default it but make it overridable for the use cases it is needed for?

Hello @jsturtevant, you mean make it overridable at the build time? It won't be possible at the runtime, as the dependencies (packer, ansible, etc.) are installed in the home directory of the user used during the build.

mdbooth

I think I'd prefer to see the user changes in a separate PR. Could we reduce this one to just adding qemu?

mdbooth · 2023-03-17T17:03:47Z

images/capi/Dockerfile

@@ -17,26 +17,22 @@
 ARG BASE_IMAGE=docker.io/library/ubuntu:latest
 FROM $BASE_IMAGE

-RUN apt-get update && apt-get install -y apt-transport-https build-essential ca-certificates curl git jq python3-pip rsync unzip vim wget \
-    && useradd -ms /bin/bash imagebuilder \
+RUN apt-get update && apt-get install -y apt-transport-https build-essential ca-certificates curl git jq python3-pip rsync unzip vim wget qemu-system-x86 \


could we also add qemu-kvm?

Added qemu-kvm and dropped the user changes.

mdbooth · 2023-03-17T17:05:15Z

/ok-to-test

this commit adds qemu amd64 binaries to build qemu images from the Docker image. example: ``` docker run -it --rm -e PACKER_FLAGS="--var 'accelerator=none'" -e OEM_ID=openstack cluster-node-image-builder-amd64 build-qemu-flatcar ``` Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>

mboersma

/lgtm
/assign @jsturtevant @kkeshavamurthy

kkeshavamurthy · 2023-03-23T19:25:43Z

/lgtm
/approve

kkeshavamurthy · 2023-03-23T19:33:20Z

/approve

kkeshavamurthy · 2023-03-30T19:04:08Z

/approve

kkeshavamurthy · 2023-03-30T19:51:35Z

maybe someone in the qemu approvers list need to approve this?

mdbooth · 2023-03-30T21:03:43Z

Pretty sure I can't, but

/approve

mdbooth · 2023-03-30T21:06:52Z

Despite what the bot says, I think it needs an approver from https://github.com/kubernetes-sigs/image-builder/blob/master/images/capi/OWNERS, which is just cluster-api-maintainers, i.e.:

@CecileRobertMichon
@enxebre
@fabriziopandini
@sbueringer
@vincepri

mboersma · 2023-03-31T16:10:16Z

I think it needs an approver from https://github.com/kubernetes-sigs/image-builder/blob/master/images/capi/OWNERS

This really shouldn't be the case, see
https://github.com/kubernetes/community/blob/master/contributors/guide/owners.md#owners
We don't set no_parent_owners: false, so I think it should be incorporating the root OWNERS/OWNERS_ALIASES files. And in fact, it always has done and it's only recently that this behavior seems to have changed.

See #1110 for an example of how it was working about two weeks ago.

sbueringer · 2023-04-12T10:15:54Z

Yup top-level approval should 100% be enough. Can we open an issue in e.g. test-infra to get some awareness / maybe someone has time to investigate? (maybe we found a recently introduced bug in the approve plugin)

Let's see if that helps for now
/approve

k8s-ci-robot · 2023-04-12T10:16:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kkeshavamurthy, mdbooth, sbueringer, tormath1

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~images/capi/OWNERS~~ [kkeshavamurthy,sbueringer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 3, 2023

k8s-ci-robot requested review from EleanorRigby and mboersma March 3, 2023 14:29

mboersma reviewed Mar 3, 2023

View reviewed changes

This was referenced Mar 10, 2023

build CAPO supported images kubernetes-sigs/cluster-api-provider-openstack#1502

Closed

REQUEST: New membership for tormath1 kubernetes/org#4097

Closed

mdbooth reviewed Mar 17, 2023

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 17, 2023

tormath1 force-pushed the tormath1/docker-qemu-builder branch 2 times, most recently from fe6c970 to 6070aef Compare March 20, 2023 09:07

tormath1 force-pushed the tormath1/docker-qemu-builder branch from 6070aef to 6b2a0ec Compare March 21, 2023 14:51

mboersma reviewed Mar 23, 2023

View reviewed changes

k8s-ci-robot assigned jsturtevant, kkeshavamurthy and mboersma Mar 23, 2023

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 23, 2023

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 12, 2023

k8s-ci-robot merged commit 2e96edb into kubernetes-sigs:master Apr 12, 2023

tormath1 deleted the tormath1/docker-qemu-builder branch April 12, 2023 10:36

tormath1 mentioned this pull request Jan 24, 2024

Don't merge Nordix/cluster-api-provider-openstack#8

Closed

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docker: support qemu target builds #1092

docker: support qemu target builds #1092

tormath1 commented Mar 3, 2023 •

edited

Loading

k8s-ci-robot commented Mar 3, 2023

mboersma Mar 3, 2023 •

edited

Loading

tormath1 Mar 3, 2023

jsturtevant Mar 7, 2023

tormath1 Mar 8, 2023

mdbooth left a comment

mdbooth Mar 17, 2023

tormath1 Mar 20, 2023

mdbooth commented Mar 17, 2023

mboersma left a comment

kkeshavamurthy commented Mar 23, 2023

kkeshavamurthy commented Mar 23, 2023

kkeshavamurthy commented Mar 30, 2023

kkeshavamurthy commented Mar 30, 2023

mdbooth commented Mar 30, 2023

mdbooth commented Mar 30, 2023

mboersma commented Mar 31, 2023 •

edited

Loading

sbueringer commented Apr 12, 2023 •

edited

Loading

k8s-ci-robot commented Apr 12, 2023

docker: support qemu target builds #1092

docker: support qemu target builds #1092

Conversation

tormath1 commented Mar 3, 2023 • edited Loading

k8s-ci-robot commented Mar 3, 2023

mboersma Mar 3, 2023 • edited Loading

Choose a reason for hiding this comment

tormath1 Mar 3, 2023

Choose a reason for hiding this comment

jsturtevant Mar 7, 2023

Choose a reason for hiding this comment

tormath1 Mar 8, 2023

Choose a reason for hiding this comment

mdbooth left a comment

Choose a reason for hiding this comment

mdbooth Mar 17, 2023

Choose a reason for hiding this comment

tormath1 Mar 20, 2023

Choose a reason for hiding this comment

mdbooth commented Mar 17, 2023

mboersma left a comment

Choose a reason for hiding this comment

kkeshavamurthy commented Mar 23, 2023

kkeshavamurthy commented Mar 23, 2023

kkeshavamurthy commented Mar 30, 2023

kkeshavamurthy commented Mar 30, 2023

mdbooth commented Mar 30, 2023

mdbooth commented Mar 30, 2023

mboersma commented Mar 31, 2023 • edited Loading

sbueringer commented Apr 12, 2023 • edited Loading

k8s-ci-robot commented Apr 12, 2023

tormath1 commented Mar 3, 2023 •

edited

Loading

mboersma Mar 3, 2023 •

edited

Loading

mboersma commented Mar 31, 2023 •

edited

Loading

sbueringer commented Apr 12, 2023 •

edited

Loading