Unify suite builders on unshare backend

AGENTS.md

@@ -28,18 +28,19 @@ Dockerfiles/
 
 | Suite     | OS     | sbuild backend | Chroot format |
 |-----------|--------|----------------|---------------|
-| noble     | Ubuntu | schroot        | `/srv/chroot/noble` (sbuild-createchroot) |
-| questing  | Ubuntu | schroot        | `/srv/chroot/questing` (sbuild-createchroot) |
+| noble     | Ubuntu | unshare        | `/root/.cache/sbuild/noble-arm64.tar` (mmdebstrap) |
+| questing  | Ubuntu | unshare        | `/root/.cache/sbuild/questing-arm64.tar` (mmdebstrap) |
 | resolute  | Ubuntu | unshare        | `/root/.cache/sbuild/resolute-arm64.tar` (mmdebstrap) |
-| trixie    | Debian | schroot        | `/srv/chroot/trixie` (sbuild-createchroot) |
+| trixie    | Debian | unshare        | `/root/.cache/sbuild/trixie-arm64.tar` (mmdebstrap) |
 | sid       | Debian | unshare        | `/root/.cache/sbuild/sid-arm64.tar` (mmdebstrap) |
 
 ## Key Design Decisions
 
-- **schroot vs. unshare**: Newer sbuild versions (resolute, sid) default to the unshare backend,
-  which expects a tarball at `/root/.cache/sbuild/<distro>-<arch>.tar`, not a `/srv/chroot/`
-  directory. Dockerfiles must use `mmdebstrap --format=tar` for these distros, and must disable
-  sbuild's unshare auto-regeneration/max-age refresh so the customized tarball is not replaced
+- **Unshare backend**: All Debian/Ubuntu suites in this repo use sbuild's
+  unshare backend with a tarball at
+  `/root/.cache/sbuild/<distro>-<arch>.tar`.
+  Dockerfiles use `mmdebstrap --format=tar` and disable sbuild's unshare
+  auto-regeneration/max-age refresh so the customized tarball is not replaced
   with a plain one that lacks Qualcomm APT sources.
 - **CA certificates in chroot**: The chroot tarball must include `ca-certificates` and `openssl`
   so that HTTPS APT repositories work inside the chroot at build time.
@@ -68,5 +69,5 @@ docker_deb_build.py -s <source-dir> -o <output-dir> -d <distro> \
 - Changes to `keyrings/` or `sources/` affect **all** distros — check every `.sources` file if
   updating suite names.
 - After any Dockerfile change, the corresponding Docker image must be rebuilt with `--rebuild`.
-- **resolute and sid**: any change to the chroot content requires updating the `mmdebstrap`
-  `--customize-hook` or `--include` flags — not a post-build `cp` into `/srv/chroot/`.
+- **all Debian/Ubuntu suites**: any change to chroot content requires updating
+  `mmdebstrap` `--customize-hook` or `--include` flags, not post-build copies.

Dockerfiles/Dockerfile.debian.trixie

@@ -12,20 +12,41 @@ RUN apt-get update && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
+# sbuild on trixie is standardized on the "unshare" backend which requires:
+#   uidmap      – newuidmap/newgidmap for user-namespace id mapping
+#   mmdebstrap  – used below to create the chroot tarball
+# Also provision subuid/subgid ranges for root so unshare can map ids.
+RUN apt-get update && \
+    apt-get install -y uidmap mmdebstrap && \
+    if ! grep -q '^root:100000:65536$' /etc/subuid; then \
+        echo 'root:100000:65536' | tee -a /etc/subuid; \
+    fi && \
+    if ! grep -q '^root:100000:65536$' /etc/subgid; then \
+        echo 'root:100000:65536' | tee -a /etc/subgid; \
+    fi
+
 COPY extra-packages.txt /tmp/extra-packages.txt
 COPY keyrings/ /tmp/keyrings/
 COPY sources/trixie/qli.sources /tmp/qli.sources
 
 RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \
-    sbuild-createchroot --include="$EXTRA_PACKAGES" \
-                        --arch=arm64 \
-                        --components=main,contrib,non-free,non-free-firmware \
-                        trixie \
-                        /srv/chroot/trixie \
-                        http://deb.debian.org/debian && \
-    mkdir -p /srv/chroot/trixie/etc/apt/keyrings && \
-    cp /tmp/keyrings/*.asc /srv/chroot/trixie/etc/apt/keyrings/ && \
-    cp /tmp/qli.sources /srv/chroot/trixie/etc/apt/sources.list.d/
+    mkdir -p /root/.cache/sbuild && \
+    mmdebstrap --variant=buildd \
+               --arch=arm64 \
+               --include="$EXTRA_PACKAGES" \
+               --skip=output/mknod \
+               --format=tar \
+               --components=main,contrib,non-free,non-free-firmware \
+               --customize-hook='mkdir -p "$1/etc/apt/keyrings" && cp /tmp/keyrings/*.asc "$1/etc/apt/keyrings/" && mkdir -p "$1/etc/apt/sources.list.d" && cp /tmp/qli.sources "$1/etc/apt/sources.list.d/"' \
+               trixie \
+               /root/.cache/sbuild/trixie-arm64.tar
+
+RUN mkdir -p /root/.config/sbuild && \
+    printf '%s\n' \
+      '$unshare_mmdebstrap_keep_tarball = 1;' \
+      '$unshare_mmdebstrap_max_age = -1;' \
+      '$unshare_mmdebstrap_auto_create = 0;' \
+      > /root/.config/sbuild/config.pl
 
 # Set working directory
 WORKDIR /workspace

Dockerfiles/Dockerfile.ubuntu.noble

@@ -12,23 +12,44 @@ RUN apt-get update && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
+# sbuild on noble is standardized on the "unshare" backend which requires:
+#   uidmap      – newuidmap/newgidmap for user-namespace id mapping
+#   mmdebstrap  – used below to create the chroot tarball
+# Also provision subuid/subgid ranges for root so unshare can map ids.
+RUN apt-get update && \
+    apt-get install -y uidmap mmdebstrap && \
+    if ! grep -q '^root:100000:65536$' /etc/subuid; then \
+        echo 'root:100000:65536' | tee -a /etc/subuid; \
+    fi && \
+    if ! grep -q '^root:100000:65536$' /etc/subgid; then \
+        echo 'root:100000:65536' | tee -a /etc/subgid; \
+    fi
+
 COPY extra-packages.txt /tmp/extra-packages.txt
 COPY keyrings/ /tmp/keyrings/
 COPY sources/noble/qsc-deb-releases.sources /tmp/qsc-deb-releases.sources
 
 RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \
-    sbuild-createchroot --include="$EXTRA_PACKAGES" \
-                        --arch=arm64 \
-                        --components=main,universe \
-                        noble \
-                        /srv/chroot/noble \
-                        http://ports.ubuntu.com && \
-    mkdir -p /srv/chroot/noble/etc/apt/keyrings && \
-    cp /tmp/keyrings/qsc-deb-releases.asc /srv/chroot/noble/etc/apt/keyrings/ && \
-    cp /tmp/qsc-deb-releases.sources /srv/chroot/noble/etc/apt/sources.list.d/
+    mkdir -p /root/.cache/sbuild && \
+    mmdebstrap --variant=buildd \
+               --arch=arm64 \
+               --include="$EXTRA_PACKAGES" \
+               --skip=output/mknod \
+               --format=tar \
+               --components=main,universe \
+               --customize-hook='mkdir -p "$1/etc/apt/keyrings" && cp /tmp/keyrings/qsc-deb-releases.asc "$1/etc/apt/keyrings/" && mkdir -p "$1/etc/apt/sources.list.d" && cp /tmp/qsc-deb-releases.sources "$1/etc/apt/sources.list.d/"' \
+               noble \
+               /root/.cache/sbuild/noble-arm64.tar
+
+RUN mkdir -p /root/.config/sbuild && \
+    printf '%s\n' \
+      '$unshare_mmdebstrap_keep_tarball = 1;' \
+      '$unshare_mmdebstrap_max_age = -1;' \
+      '$unshare_mmdebstrap_auto_create = 0;' \
+      > /root/.config/sbuild/config.pl
 
 # Set working directory
 WORKDIR /workspace
 
 # Default command
-CMD [ "bash" ]
+CMD [ "bash" ]

Dockerfiles/Dockerfile.ubuntu.questing

@@ -12,23 +12,44 @@ RUN apt-get update && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
+# sbuild on questing is standardized on the "unshare" backend which requires:
+#   uidmap      – newuidmap/newgidmap for user-namespace id mapping
+#   mmdebstrap  – used below to create the chroot tarball
+# Also provision subuid/subgid ranges for root so unshare can map ids.
+RUN apt-get update && \
+    apt-get install -y uidmap mmdebstrap && \
+    if ! grep -q '^root:100000:65536$' /etc/subuid; then \
+        echo 'root:100000:65536' | tee -a /etc/subuid; \
+    fi && \
+    if ! grep -q '^root:100000:65536$' /etc/subgid; then \
+        echo 'root:100000:65536' | tee -a /etc/subgid; \
+    fi
+
 COPY extra-packages.txt /tmp/extra-packages.txt
 COPY keyrings/ /tmp/keyrings/
 COPY sources/questing/qsc-deb-releases.sources /tmp/qsc-deb-releases.sources
 
 RUN EXTRA_PACKAGES=$(tr -s '[:space:]' ',' < /tmp/extra-packages.txt) && \
-    sbuild-createchroot --include="$EXTRA_PACKAGES" \
-                        --arch=arm64 \
-                        --components=main,universe \
-                        questing \
-                        /srv/chroot/questing \
-                        http://ports.ubuntu.com && \
-    mkdir -p /srv/chroot/questing/etc/apt/keyrings && \
-    cp /tmp/keyrings/qsc-deb-releases.asc /srv/chroot/questing/etc/apt/keyrings/ && \
-    cp /tmp/qsc-deb-releases.sources /srv/chroot/questing/etc/apt/sources.list.d/
+    mkdir -p /root/.cache/sbuild && \
+    mmdebstrap --variant=buildd \
+               --arch=arm64 \
+               --include="$EXTRA_PACKAGES" \
+               --skip=output/mknod \
+               --format=tar \
+               --components=main,universe \
+               --customize-hook='mkdir -p "$1/etc/apt/keyrings" && cp /tmp/keyrings/qsc-deb-releases.asc "$1/etc/apt/keyrings/" && mkdir -p "$1/etc/apt/sources.list.d" && cp /tmp/qsc-deb-releases.sources "$1/etc/apt/sources.list.d/"' \
+               questing \
+               /root/.cache/sbuild/questing-arm64.tar
+
+RUN mkdir -p /root/.config/sbuild && \
+    printf '%s\n' \
+      '$unshare_mmdebstrap_keep_tarball = 1;' \
+      '$unshare_mmdebstrap_max_age = -1;' \
+      '$unshare_mmdebstrap_auto_create = 0;' \
+      > /root/.config/sbuild/config.pl
 
 # Set working directory
 WORKDIR /workspace
 
 # Default command
-CMD [ "bash" ]
+CMD [ "bash" ]

README.md

@@ -111,6 +111,7 @@ docker_deb_build.py --help
 - **Docker-based Builds**: Packages are built inside isolated Docker containers to ensure reproducibility.
 - **Per-suite Builder Images**: Includes one Dockerfile and one prebuilt sbuild environment per supported suite.
 - **Supported Suites**: Supports Ubuntu `noble`, `questing`, `resolute` and Debian `trixie`, `sid`.
+- **Unified sbuild Backend**: All Debian/Ubuntu suites use sbuild unshare tarballs created with mmdebstrap.
 - **Host-backed `/tmp` option for large builds**: `--mount-host-tmp` bind-mounts host `/tmp` to container `/tmp`.
 - **Automated Workflows**: Integrates with GitHub Actions via the `qcom-container-build-and-upload.yml` workflow for CI/CD.