From fb0b163e092309b99422f89b5e37d9925dfe7038 Mon Sep 17 00:00:00 2001 From: Simon Beaudoin Date: Mon, 29 Jun 2026 14:32:26 -0700 Subject: [PATCH] standardize suites on unshare backend Switch noble, questing, and trixie Dockerfiles from sbuild-createchroot/schroot setup to unshare tarball setup using mmdebstrap, matching resolute and sid behavior. Update AGENTS.md and README.md to reflect unified unshare backend expectations across Debian/Ubuntu suites. Signed-off-by: Simon Beaudoin --- AGENTS.md | 19 ++++++------ Dockerfiles/Dockerfile.debian.trixie | 39 ++++++++++++++++++------ Dockerfiles/Dockerfile.ubuntu.noble | 41 +++++++++++++++++++------- Dockerfiles/Dockerfile.ubuntu.questing | 41 +++++++++++++++++++------- README.md | 1 + 5 files changed, 103 insertions(+), 38 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 078c187..e747e2b 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -28,18 +28,19 @@ Dockerfiles/ | Suite | OS | sbuild backend | Chroot format | |-----------|--------|----------------|---------------| -| noble | Ubuntu | schroot | `/srv/chroot/noble` (sbuild-createchroot) | -| questing | Ubuntu | schroot | `/srv/chroot/questing` (sbuild-createchroot) | +| noble | Ubuntu | unshare | `/root/.cache/sbuild/noble-arm64.tar` (mmdebstrap) | +| questing | Ubuntu | unshare | `/root/.cache/sbuild/questing-arm64.tar` (mmdebstrap) | | resolute | Ubuntu | unshare | `/root/.cache/sbuild/resolute-arm64.tar` (mmdebstrap) | -| trixie | Debian | schroot | `/srv/chroot/trixie` (sbuild-createchroot) | +| trixie | Debian | unshare | `/root/.cache/sbuild/trixie-arm64.tar` (mmdebstrap) | | sid | Debian | unshare | `/root/.cache/sbuild/sid-arm64.tar` (mmdebstrap) | ## Key Design Decisions -- **schroot vs. unshare**: Newer sbuild versions (resolute, sid) default to the unshare backend, - which expects a tarball at `/root/.cache/sbuild/-.tar`, not a `/srv/chroot/` - directory. Dockerfiles must use `mmdebstrap --format=tar` for these distros, and must disable - sbuild's unshare auto-regeneration/max-age refresh so the customized tarball is not replaced +- **Unshare backend**: All Debian/Ubuntu suites in this repo use sbuild's + unshare backend with a tarball at + `/root/.cache/sbuild/-.tar`. + Dockerfiles use `mmdebstrap --format=tar` and disable sbuild's unshare + auto-regeneration/max-age refresh so the customized tarball is not replaced with a plain one that lacks Qualcomm APT sources. - **CA certificates in chroot**: The chroot tarball must include `ca-certificates` and `openssl` so that HTTPS APT repositories work inside the chroot at build time. @@ -68,5 +69,5 @@ docker_deb_build.py -s -o -d \ - Changes to `keyrings/` or `sources/` affect **all** distros — check every `.sources` file if updating suite names. - After any Dockerfile change, the corresponding Docker image must be rebuilt with `--rebuild`. -- **resolute and sid**: any change to the chroot content requires updating the `mmdebstrap` - `--customize-hook` or `--include` flags — not a post-build `cp` into `/srv/chroot/`. +- **all Debian/Ubuntu suites**: any change to chroot content requires updating + `mmdebstrap` `--customize-hook` or `--include` flags, not post-build copies. diff --git a/Dockerfiles/Dockerfile.debian.trixie b/Dockerfiles/Dockerfile.debian.trixie index 8488c7c..7f0339d 100644 --- a/Dockerfiles/Dockerfile.debian.trixie +++ b/Dockerfiles/Dockerfile.debian.trixie @@ -12,20 +12,41 @@ RUN apt-get update && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* +# sbuild on trixie is standardized on the "unshare" backend which requires: +# uidmap – newuidmap/newgidmap for user-namespace id mapping +# mmdebstrap – used below to create the chroot tarball +# Also provision subuid/subgid ranges for root so unshare can map ids. +RUN apt-get update && \ + apt-get install -y uidmap mmdebstrap && \ + if ! grep -q '^root:100000:65536$' /etc/subuid; then \ + echo 'root:100000:65536' | tee -a /etc/subuid; \ + fi && \ + if ! grep -q '^root:100000:65536$' /etc/subgid; then \ + echo 'root:100000:65536' | tee -a /etc/subgid; \ + fi + COPY extra-packages.txt /tmp/extra-packages.txt COPY keyrings/ /tmp/keyrings/ COPY sources/trixie/qli.sources /tmp/qli.sources RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \ - sbuild-createchroot --include="$EXTRA_PACKAGES" \ - --arch=arm64 \ - --components=main,contrib,non-free,non-free-firmware \ - trixie \ - /srv/chroot/trixie \ - http://deb.debian.org/debian && \ - mkdir -p /srv/chroot/trixie/etc/apt/keyrings && \ - cp /tmp/keyrings/*.asc /srv/chroot/trixie/etc/apt/keyrings/ && \ - cp /tmp/qli.sources /srv/chroot/trixie/etc/apt/sources.list.d/ + mkdir -p /root/.cache/sbuild && \ + mmdebstrap --variant=buildd \ + --arch=arm64 \ + --include="$EXTRA_PACKAGES" \ + --skip=output/mknod \ + --format=tar \ + --components=main,contrib,non-free,non-free-firmware \ + --customize-hook='mkdir -p "$1/etc/apt/keyrings" && cp /tmp/keyrings/*.asc "$1/etc/apt/keyrings/" && mkdir -p "$1/etc/apt/sources.list.d" && cp /tmp/qli.sources "$1/etc/apt/sources.list.d/"' \ + trixie \ + /root/.cache/sbuild/trixie-arm64.tar + +RUN mkdir -p /root/.config/sbuild && \ + printf '%s\n' \ + '$unshare_mmdebstrap_keep_tarball = 1;' \ + '$unshare_mmdebstrap_max_age = -1;' \ + '$unshare_mmdebstrap_auto_create = 0;' \ + > /root/.config/sbuild/config.pl # Set working directory WORKDIR /workspace diff --git a/Dockerfiles/Dockerfile.ubuntu.noble b/Dockerfiles/Dockerfile.ubuntu.noble index f09d7a5..5cf530e 100644 --- a/Dockerfiles/Dockerfile.ubuntu.noble +++ b/Dockerfiles/Dockerfile.ubuntu.noble @@ -12,23 +12,44 @@ RUN apt-get update && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* +# sbuild on noble is standardized on the "unshare" backend which requires: +# uidmap – newuidmap/newgidmap for user-namespace id mapping +# mmdebstrap – used below to create the chroot tarball +# Also provision subuid/subgid ranges for root so unshare can map ids. +RUN apt-get update && \ + apt-get install -y uidmap mmdebstrap && \ + if ! grep -q '^root:100000:65536$' /etc/subuid; then \ + echo 'root:100000:65536' | tee -a /etc/subuid; \ + fi && \ + if ! grep -q '^root:100000:65536$' /etc/subgid; then \ + echo 'root:100000:65536' | tee -a /etc/subgid; \ + fi + COPY extra-packages.txt /tmp/extra-packages.txt COPY keyrings/ /tmp/keyrings/ COPY sources/noble/qsc-deb-releases.sources /tmp/qsc-deb-releases.sources RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \ - sbuild-createchroot --include="$EXTRA_PACKAGES" \ - --arch=arm64 \ - --components=main,universe \ - noble \ - /srv/chroot/noble \ - http://ports.ubuntu.com && \ - mkdir -p /srv/chroot/noble/etc/apt/keyrings && \ - cp /tmp/keyrings/qsc-deb-releases.asc /srv/chroot/noble/etc/apt/keyrings/ && \ - cp /tmp/qsc-deb-releases.sources /srv/chroot/noble/etc/apt/sources.list.d/ + mkdir -p /root/.cache/sbuild && \ + mmdebstrap --variant=buildd \ + --arch=arm64 \ + --include="$EXTRA_PACKAGES" \ + --skip=output/mknod \ + --format=tar \ + --components=main,universe \ + --customize-hook='mkdir -p "$1/etc/apt/keyrings" && cp /tmp/keyrings/qsc-deb-releases.asc "$1/etc/apt/keyrings/" && mkdir -p "$1/etc/apt/sources.list.d" && cp /tmp/qsc-deb-releases.sources "$1/etc/apt/sources.list.d/"' \ + noble \ + /root/.cache/sbuild/noble-arm64.tar + +RUN mkdir -p /root/.config/sbuild && \ + printf '%s\n' \ + '$unshare_mmdebstrap_keep_tarball = 1;' \ + '$unshare_mmdebstrap_max_age = -1;' \ + '$unshare_mmdebstrap_auto_create = 0;' \ + > /root/.config/sbuild/config.pl # Set working directory WORKDIR /workspace # Default command -CMD [ "bash" ] \ No newline at end of file +CMD [ "bash" ] diff --git a/Dockerfiles/Dockerfile.ubuntu.questing b/Dockerfiles/Dockerfile.ubuntu.questing index 8eef6ec..2d9e3ba 100644 --- a/Dockerfiles/Dockerfile.ubuntu.questing +++ b/Dockerfiles/Dockerfile.ubuntu.questing @@ -12,23 +12,44 @@ RUN apt-get update && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* +# sbuild on questing is standardized on the "unshare" backend which requires: +# uidmap – newuidmap/newgidmap for user-namespace id mapping +# mmdebstrap – used below to create the chroot tarball +# Also provision subuid/subgid ranges for root so unshare can map ids. +RUN apt-get update && \ + apt-get install -y uidmap mmdebstrap && \ + if ! grep -q '^root:100000:65536$' /etc/subuid; then \ + echo 'root:100000:65536' | tee -a /etc/subuid; \ + fi && \ + if ! grep -q '^root:100000:65536$' /etc/subgid; then \ + echo 'root:100000:65536' | tee -a /etc/subgid; \ + fi + COPY extra-packages.txt /tmp/extra-packages.txt COPY keyrings/ /tmp/keyrings/ COPY sources/questing/qsc-deb-releases.sources /tmp/qsc-deb-releases.sources RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \ - sbuild-createchroot --include="$EXTRA_PACKAGES" \ - --arch=arm64 \ - --components=main,universe \ - questing \ - /srv/chroot/questing \ - http://ports.ubuntu.com && \ - mkdir -p /srv/chroot/questing/etc/apt/keyrings && \ - cp /tmp/keyrings/qsc-deb-releases.asc /srv/chroot/questing/etc/apt/keyrings/ && \ - cp /tmp/qsc-deb-releases.sources /srv/chroot/questing/etc/apt/sources.list.d/ + mkdir -p /root/.cache/sbuild && \ + mmdebstrap --variant=buildd \ + --arch=arm64 \ + --include="$EXTRA_PACKAGES" \ + --skip=output/mknod \ + --format=tar \ + --components=main,universe \ + --customize-hook='mkdir -p "$1/etc/apt/keyrings" && cp /tmp/keyrings/qsc-deb-releases.asc "$1/etc/apt/keyrings/" && mkdir -p "$1/etc/apt/sources.list.d" && cp /tmp/qsc-deb-releases.sources "$1/etc/apt/sources.list.d/"' \ + questing \ + /root/.cache/sbuild/questing-arm64.tar + +RUN mkdir -p /root/.config/sbuild && \ + printf '%s\n' \ + '$unshare_mmdebstrap_keep_tarball = 1;' \ + '$unshare_mmdebstrap_max_age = -1;' \ + '$unshare_mmdebstrap_auto_create = 0;' \ + > /root/.config/sbuild/config.pl # Set working directory WORKDIR /workspace # Default command -CMD [ "bash" ] \ No newline at end of file +CMD [ "bash" ] diff --git a/README.md b/README.md index ae45164..98d6a33 100644 --- a/README.md +++ b/README.md @@ -111,6 +111,7 @@ docker_deb_build.py --help - **Docker-based Builds**: Packages are built inside isolated Docker containers to ensure reproducibility. - **Per-suite Builder Images**: Includes one Dockerfile and one prebuilt sbuild environment per supported suite. - **Supported Suites**: Supports Ubuntu `noble`, `questing`, `resolute` and Debian `trixie`, `sid`. +- **Unified sbuild Backend**: All Debian/Ubuntu suites use sbuild unshare tarballs created with mmdebstrap. - **Host-backed `/tmp` option for large builds**: `--mount-host-tmp` bind-mounts host `/tmp` to container `/tmp`. - **Automated Workflows**: Integrates with GitHub Actions via the `qcom-container-build-and-upload.yml` workflow for CI/CD.