Skip to content

Support both podman and docker #89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
legoktm wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Support both podman and docker #89

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 1 addition & 10 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ in your password manager.
## Building kernels in Qubes

Here's how to set up a build environment in [Qubes], suitable for use with [SecureDrop].
The build requires `docker`, so make sure your TemplateVM has docker configured.
The build requires `podman` or `docker`, so make sure your TemplateVM has one of those set up.

```
qvm-create sd-kernel-builder --template debian-11 --label purple
Expand All @@ -42,15 +42,6 @@ qvm-volume resize sd-kernel-builder:private 50G

```

Then add the following customization to the AppVM to ensure
the private volume [bind-dir](https://www.qubes-os.org/doc/bind-dirs/)
is used for the build:

```
sudo mkdir -p /rw/config/qubes-bind-dirs.d
echo "binds+=( '/var/lib/docker' )" | sudo tee -a /rw/config/qubes-bind-dirs.d/50_user.conf
```

And reboot the AppVM. Otherwise, you will need a large system partition.
Finally, make sure you've got the [grsec env vars](##enabling-grsecurity-patches)
exported in your environment, or set in e.g. `~/grsec-env`, as below. Now build:
Expand Down
20 changes: 16 additions & 4 deletions scripts/build-kernel-wrapper
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,16 @@ export DEB_BUILD_TIMESTAMP="${SOURCE_DATE_EPOCH}"
export TERM=dumb # to omit control characters from "script" transcripts
export BUILD_DISTRO="${BUILD_DISTRO:-bookworm}"

# Container runtime; podman is preferred, docker also works
CONTAINER_RUNTIME="${CONTAINER_RUNTIME:-$(command -v podman || command -v docker || true)}"
if [[ -z "$CONTAINER_RUNTIME" ]]; then
echo "ERROR: podman or docker is required" >&2
exit 1
fi

# Build container image for kernel dependencies
IMG_NAME="fpf.local/kernel-builder"
docker build -t "${IMG_NAME}-${BUILD_DISTRO}" \
"$CONTAINER_RUNTIME" build -t "${IMG_NAME}-${BUILD_DISTRO}" \
--build-arg UID="$(id -u)" \
--build-arg GID="$(id -g)" \
--build-arg BUILD_DISTRO="$BUILD_DISTRO" \
Expand All @@ -25,11 +32,11 @@ docker build -t "${IMG_NAME}-${BUILD_DISTRO}" \
# Configure local customizations
local_config_volume_opt=""
if [[ -n "${LINUX_LOCAL_CONFIG_PATH:-}" ]]; then
local_config_volume_opt="-v ${LINUX_LOCAL_CONFIG_PATH}:/config:ro"
local_config_volume_opt="-v ${LINUX_LOCAL_CONFIG_PATH}:/config:ro,z"
fi
local_patches_volume_opt=""
if [[ -n "${LINUX_LOCAL_PATCHES_PATH:-}" ]]; then
local_patches_volume_opt="-v ${LINUX_LOCAL_PATCHES_PATH}:/patches:ro"
local_patches_volume_opt="-v ${LINUX_LOCAL_PATCHES_PATH}:/patches:ro,z"
fi

# Create output dir
Expand All @@ -41,8 +48,13 @@ DOCKER_RUN_ARGUMENTS=""
if test -t 0; then
DOCKER_RUN_ARGUMENTS="${DOCKER_RUN_ARGUMENTS} -it"
fi
if [[ "$CONTAINER_RUNTIME" == *podman ]]; then
# rootless podman maps the invoking user to container root, so without this
# the build user can't write to /output
DOCKER_RUN_ARGUMENTS="${DOCKER_RUN_ARGUMENTS} --userns=keep-id"
fi

docker run --rm $DOCKER_RUN_ARGUMENTS \
"$CONTAINER_RUNTIME" run --rm $DOCKER_RUN_ARGUMENTS \
-e GRSECURITY_USERNAME \
-e GRSECURITY_PASSWORD \
-e GRSECURITY_PATCH_TYPE \
Expand Down