Re: [RFC cip-dev][isar-cip-core][PATCH 1/4] update to kas 5.4

On 7/27/26 8:07 AM, Jan Kiszka wrote:
> On 24.07.26 12:51, Quirin Gylstorff wrote:
>> From: Quirin Gylstorff <[email protected]>
>>
>> Signed-off-by: Quirin Gylstorff <[email protected]>
>> ---
>>   .gitlab-ci.yml |   2 +-
>>   kas-cip.yml    |   2 +-
>>   kas-container  | 311 ++++++++++++++++++++++++++-----------------------
>>   3 files changed, 170 insertions(+), 145 deletions(-)
>>
>> diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
>> index b53def4..1e61cb0 100644
>> --- a/.gitlab-ci.yml
>> +++ b/.gitlab-ci.yml
>> @@ -33,7 +33,7 @@ stages:
>>     - cve-check
>>   
>>   default:
>> -  image: ghcr.io/siemens/kas/kas-isar:5.2
>> +  image: ghcr.io/siemens/kas/kas-isar:5.4
>>     before_script:
>>       - export http_proxy=$HTTP_PROXY
>>       - export https_proxy=$HTTPS_PROXY
>> diff --git a/kas-cip.yml b/kas-cip.yml
>> index 23bbba4..6badc7d 100644
>> --- a/kas-cip.yml
>> +++ b/kas-cip.yml
>> @@ -15,7 +15,7 @@ header:
>>   distro: cip-core-trixie
>>   target: cip-core-image
>>   
>> -build_system: isar
>> +build_system: isar-privileged
>>   
>>   repos:
>>     cip-core:
>> diff --git a/kas-container b/kas-container
>> index 993f0bb..55bdcfc 100755
>> --- a/kas-container
>> +++ b/kas-container
>> @@ -27,7 +27,7 @@
>>   
>>   set -e
>>   
>> -KAS_CONTAINER_SCRIPT_VERSION="5.2"
>> +KAS_CONTAINER_SCRIPT_VERSION="5.4"
>>   KAS_IMAGE_VERSION_DEFAULT="${KAS_CONTAINER_SCRIPT_VERSION}"
>>   KAS_CONTAINER_IMAGE_DISTRO_DEFAULT=""
>>   KAS_CONTAINER_IMAGE_PATH_DEFAULT="ghcr.io/siemens/kas"
>> @@ -49,9 +49,10 @@ usage()
>>   	printf "%b" "\nPositional arguments:\n"
>>   	printf "%b" "build\t\t\tCheck out repositories and build target.\n"
>>   	printf "%b" "checkout\t\tCheck out repositories but do not build.\n"
>> +	printf "%b" "diff\t\t\tCompare two kas configurations.\n"
>>   	printf "%b" "dump\t\t\tCheck out repositories and write flat version\n"
>>   	printf "%b" "    \t\t\tof config to stdout.\n"
>> -	printf "%b" "lock\t\t\tCreate and update kas project lockfiles\n"
>> +	printf "%b" "lock\t\t\tCreate and update kas project lockfiles.\n"
>>   	printf "%b" "shell\t\t\tRun a shell in the build environment.\n"
>>   	printf "%b" "for-all-repos\t\tRun specified command in each repository.\n"
>>   	printf "%b" "clean\t\t\tClean build artifacts, keep sstate cache and " \
>> @@ -61,20 +62,19 @@ usage()
>>   	printf "%b" "cleanall\t\tClean build artifacts, sstate cache and " \
>>   		    "downloads.\n"
>>   	printf "%b" "purge\t\t\tRemove all data managed by kas. Run with '--dry-run'\n"
>> -	printf "%b" "     \t\t\tto check what would be removed\n"
>> +	printf "%b" "     \t\t\tto check what would be removed.\n"
>>   	printf "%b" "menu\t\t\tProvide configuration menu and trigger " \
>>   		    "configured build.\n"
>>   	printf "%b" "\nOptional arguments:\n"
>> -	printf "%b" "--isar\t\t\tUse kas-isar container to build Isar image. To force\n"
>> -	printf "%b" "      \t\t\tthe use of run0 over sudo, set KAS_SUDO_CMD=run0.\n"
>> -	printf "%b" "--with-loop-dev		Pass a loop device to the " \
>> -		    "container. Only required if\n"
>> -	printf "%b" "\t\t\tloop-mounting is used by recipes.\n"
>> +	printf "%b" "--isar-privileged\tRun an Isar build in privileged mode. " \
>> +	            "To force the use\n"
>> +	printf "%b" "\t\t\tof run0 over sudo, set KAS_SUDO_CMD=run0.\n"
>> +	printf "%b" "--isar-rootless\t\tRun an Isar build in rootless mode.\n"
>>   	printf "%b" "--runtime-args\t\tAdditional arguments to pass to the " \
>> -			"container runtime\n"
>> +			"container runtime.\n"
>>   	printf "%b" "\t\t\tfor running the build.\n"
>>   	printf "%b" "-l, --log-level\t\tSet log level (default=info).\n"
>> -	printf "%b" "--version\t\tprint program version.\n"
>> +	printf "%b" "--version\t\tPrint program version.\n"
>>   	printf "%b" "--ssh-dir\t\tDirectory containing SSH configurations.\n"
>>   	printf "%b" "\t\t\tAvoid \$HOME/.ssh unless you fully trust the " \
>>   		    "container.\n"
>> @@ -83,13 +83,15 @@ usage()
>>   	printf "%b" "\t\t\tAvoid \$HOME/.aws unless you fully trust the " \
>>   		    "container.\n"
>>   	printf "%b" "--git-credential-store\tFile path to the git credential " \
>> -		    "store\n"
>> +		    "store.\n"
>> +	printf "%b" "--git-credential-socket\tPath to the git credential cache " \
>> +	       "socket.\n"
>>   	printf "%b" "--no-proxy-from-env\tDo not inherit proxy settings from " \
>>   		    "environment.\n"
>>   	printf "%b" "--repo-ro\t\tMount current repository read-only\n" \
>> -		    "\t\t\t(default for build command)\n"
>> +		    "\t\t\t(default for build command).\n"
>>   	printf "%b" "--repo-rw\t\tMount current repository writable\n" \
>> -		    "\t\t\t(default for shell command)\n"
>> +		    "\t\t\t(default for shell command).\n"
>>   	printf "%b" "-h, --help\t\tShow this help message and exit.\n"
>>   	printf "%b" "\n"
>>   	printf "%b" "You can force the use of podman over docker using " \
>> @@ -143,11 +145,6 @@ prepare_sudo_cmd()
>>   
>>   enable_isar_mode()
>>   {
>> -	if [ -n "${ISAR_MODE}" ]; then
>> -		return
>> -	fi
>> -	ISAR_MODE=1
>> -
>>   	KAS_CONTAINER_IMAGE_NAME_DEFAULT="kas-isar"
>>   	KAS_ISAR_ARGS="--privileged"
>>   
>> @@ -159,14 +156,38 @@ enable_isar_mode()
>>   		export PATH="${PATH}:/usr/sbin"
>>   	elif [ "${KAS_DOCKER_ROOTLESS}" = "1" ]; then
>>   		prepare_sudo_cmd
>> -		export DOCKER_HOST="${DOCKER_HOST:-unix:///var/run/docker.sock}"
>> -		debug "kas-isar does not support rootless docker. Using system docker"
>> +		DOCKER_HOST_DEFAULT="$(docker context inspect default --format '{{.Endpoints.docker.Host}}')"
>> +		export DOCKER_HOST="${DOCKER_HOST:-$DOCKER_HOST_DEFAULT}"
>> +		debug "kas-isar does not support rootless docker. Using system docker in $DOCKER_HOST"
>>   		# force use of well-known system docker socket
>>   		KAS_CONTAINER_COMMAND="${_KAS_SUDO_CMD} ${KAS_CONTAINER_COMMAND}"
>>   		KAS_DOCKER_ROOTLESS=0
>>   	fi
>>   }
>>   
>> +enable_isar_rootless_mode()
>> +{
>> +	KAS_CONTAINER_IMAGE_NAME_DEFAULT="kas-isar"
>> +
>> +	# Use --privileged to pass the ambient capabilities into the container.
>> +	# When calling from the user session (podman or docker-rootless), this
>> +	# is fundamentally different from the system docker run --privileged
>> +	if [ "${KAS_CONTAINER_ENGINE}" = "podman" ]; then
>> +		KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --userns=keep-id --privileged"
>> +	elif [ "${KAS_DOCKER_ROOTLESS}" = "1" ]; then
>> +		KAS_ISAR_ARGS="--privileged"
>> +	else
>> +		# we don't need --privileged, but we need to run with SYS_ADMIN
>> +		# to be able to unshare.
>> +		KAS_ISAR_ARGS=" \
>> +			--security-opt seccomp=unconfined \
>> +			--security-opt apparmor=unconfined \
>> +			--security-opt systempaths=unconfined \
>> +			--cap-add=SYS_ADMIN \
>> +		"
>> +	fi
>> +}
>> +
>>   enable_oe_mode()
>>   {
>>   	if [ "${KAS_CONTAINER_ENGINE}" = "podman" ]; then
>> @@ -174,6 +195,7 @@ enable_oe_mode()
>>   		# calling "podman run" has a 1:1 mapping
>>   		KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --userns=keep-id"
>>   	fi
>> +	BUILD_SYSTEM="openembedded"
>>   }
>>   
>>   enable_unpriv_userns_docker()
>> @@ -210,6 +232,20 @@ check_and_expand()
>>   	realpath -e "$_varval"
>>   }
>>   
>> +# SC2034: DIR appears unused (ignore, as they are used inside eval)
>> +# shellcheck disable=2034
>> +setup_kas_dirs()
>> +{
>> +	KAS_WORK_DIR="${KAS_WORK_DIR:-$(pwd)}"
>> +	KAS_WORK_DIR="$(check_and_expand KAS_WORK_DIR required)"
>> +	KAS_BUILD_DIR="$(check_and_expand KAS_BUILD_DIR create)"
>> +	KAS_REPO_REF_DIR="$(check_and_expand KAS_REPO_REF_DIR required)"
>> +	DL_DIR="$(check_and_expand DL_DIR createrec)"
>> +	SSTATE_DIR="$(check_and_expand SSTATE_DIR createrec)"
>> +	BB_HASHSERVE_DB_DIR="$(check_and_expand BB_HASHSERVE_DB_DIR createrec)"
>> +	KAS_BUILDTOOLS_DIR="$(check_and_expand KAS_BUILDTOOLS_DIR createrec)"
>> +}
>> +
>>   # Params: FILE
>>   # Returns: root repo dir of file
>>   repo_path_of_file()
>> @@ -260,14 +296,6 @@ forward_dir()
>>   	fi
>>   }
>>   
>> -check_docker_rootless()
>> -{
>> -	KAS_DOCKER_ROOTLESS=0
>> -	if [ "$(docker context show)" = "rootless" ]; then
>> -		KAS_DOCKER_ROOTLESS=1
>> -	fi
>> -}
>> -
>>   enable_docker_rootless()
>>   {
>>   	warning "Rootless docker used, only limited functionality available."
>> @@ -281,122 +309,48 @@ enable_docker_rootless()
>>   	KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} -e KAS_DOCKER_ROOTLESS=1"
>>   }
>>   
>> -KAS_GIT_OVERLAY_FILE=""
>> -kas_container_cleanup()
>> -{
>> -	if [ -f "${KAS_GIT_OVERLAY_FILE}" ]; then
>> -		trace rm -f "${KAS_GIT_OVERLAY_FILE}"
>> -	fi
>> -}
>> -trap kas_container_cleanup EXIT INT TERM
>> -
>>   set_container_image_var()
>>   {
>> +	# if the image is explicitly set, use that
>> +	if [ -n "${KAS_CONTAINER_IMAGE}" ]; then
>> +		return
>> +	fi
>>   	KAS_IMAGE_VERSION="${KAS_IMAGE_VERSION:-${KAS_IMAGE_VERSION_DEFAULT}}"
>>   	KAS_CONTAINER_IMAGE_DISTRO="${KAS_CONTAINER_IMAGE_DISTRO:-${KAS_CONTAINER_IMAGE_DISTRO_DEFAULT}}"
>>   	KAS_CONTAINER_IMAGE_NAME="${KAS_CONTAINER_IMAGE_NAME:-${KAS_CONTAINER_IMAGE_NAME_DEFAULT}}"
>>   	KAS_CONTAINER_IMAGE_PATH="${KAS_CONTAINER_IMAGE_PATH:-${KAS_CONTAINER_IMAGE_PATH_DEFAULT}}"
>> -	KAS_CONTAINER_IMAGE_DEFAULT="${KAS_CONTAINER_IMAGE_PATH}/${KAS_CONTAINER_IMAGE_NAME}:${KAS_IMAGE_VERSION}"
>> -	KAS_CONTAINER_IMAGE="${KAS_CONTAINER_IMAGE:-${KAS_CONTAINER_IMAGE_DEFAULT}}"
>> +	KAS_CONTAINER_IMAGE="${KAS_CONTAINER_IMAGE_PATH}/${KAS_CONTAINER_IMAGE_NAME}:${KAS_IMAGE_VERSION}"
>>   	if [ -n "${KAS_CONTAINER_IMAGE_DISTRO}" ]; then
>>   		KAS_CONTAINER_IMAGE="${KAS_CONTAINER_IMAGE}-${KAS_CONTAINER_IMAGE_DISTRO}"
>>   	fi
>>   }
>>   
>> -# SC2034: DIR appears unused (ignore, as they are used inside eval)
>> -# shellcheck disable=2034
>> -setup_kas_dirs()
>> -{
>> -	KAS_WORK_DIR="${KAS_WORK_DIR:-$(pwd)}"
>> -	KAS_WORK_DIR="$(check_and_expand KAS_WORK_DIR required)"
>> -	KAS_BUILD_DIR="$(check_and_expand KAS_BUILD_DIR create)"
>> -	KAS_REPO_REF_DIR="$(check_and_expand KAS_REPO_REF_DIR required)"
>> -	DL_DIR="$(check_and_expand DL_DIR createrec)"
>> -	SSTATE_DIR="$(check_and_expand SSTATE_DIR createrec)"
>> -	KAS_BUILDTOOLS_DIR="$(check_and_expand KAS_BUILDTOOLS_DIR createrec)"
>> -}
>> -setup_kas_dirs
>> -
>> -KAS_CONTAINER_ENGINE="${KAS_CONTAINER_ENGINE:-${KAS_DOCKER_ENGINE}}"
>> -if [ -z "${KAS_CONTAINER_ENGINE}" ]; then
>> -	# Try to auto-detect a container engine
>> -	if command -v docker >/dev/null; then
>> -		case $(docker -v 2>/dev/null) in
>> -		podman*)
>> -			# The docker command is an alias for podman
>> -			KAS_CONTAINER_ENGINE=podman
>> -			;;
>> -		Docker*)
>> -			# The docker command is the real docker
>> -			KAS_CONTAINER_ENGINE=docker
>> -			;;
>> -		*)
>> -			# The docker command is an unknown engine
>> -			fatal_error "docker command found, but unknown engine detected"
>> -		esac
>> -	elif command -v podman >/dev/null; then
>> -		KAS_CONTAINER_ENGINE=podman
>> -	else
>> -		fatal_error "no container engine found, need docker or podman"
>> -	fi
>> -fi
>> -
>> -KAS_RUNTIME_ARGS="--log-driver=none --user=root"
>> -
>> -case "${KAS_CONTAINER_ENGINE}" in
>> -docker)
>> -	KAS_CONTAINER_COMMAND="docker"
>> -	enable_unpriv_userns_docker
>> -	check_docker_rootless
>> -	;;
>> -podman)
>> -	KAS_CONTAINER_COMMAND="podman"
>> -	KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --security-opt label=disable"
>> -	;;
>> -*)
>> -	fatal_error "unknown container engine '${KAS_CONTAINER_ENGINE}'"
>> -	;;
>> -esac
>> -
>> -# parse kas-container options
>> +# parse kas-container options, leave build system empty to distinguish between
>> +# explicitly set via flag and implicitly via config.
>> +BUILD_SYSTEM=""
>> +KAS_OPTIONS_DIRECT=""
>> +KAS_EXTRA_RUNTIME_ARGS=""
>>   while [ $# -gt 0 ]; do
>>   	case "$1" in
>> -	--isar)
>> -		enable_isar_mode
>> +	--isar | --isar-privileged)
>> +		if [ "$1" = "--isar" ]; then
>> +			warning "The semantic of '--isar' might change in the" \
>> +				"future. Please use '--isar-privileged' instead."
>> +		fi
>> +		BUILD_SYSTEM="isar-privileged"
>>   		shift 1
>>   		;;
>> -	--with-loop-dev)
>> -		if ! KAS_LOOP_DEV=$(/sbin/losetup -f 2>/dev/null); then
>> -			if [ "$(id -u)" -eq 0 ]; then
>> -				fatal_error "loop device not available!"
>> -			fi
>> -			prepare_sudo_cmd
>> -			if ! [ "$KAS_SUDO_CMD" = "sudo" ]; then
>> -				fatal_error '--with-loop-dev requires sudo for device setup.'
>> -			fi
>> -			sudo_command="/sbin/losetup -f"
>> -			sudo_message="[sudo] enter password to setup loop"
>> -			sudo_message="$sudo_message devices by calling"
>> -			sudo_message="$sudo_message '$sudo_command': "
>> -			# SC2086: Double quote to prevent globbing and word splitting.
>> -			# shellcheck disable=2086
>> -			if ! KAS_LOOP_DEV=$(sudo -p "$sudo_message" $sudo_command \
>> -				2>/dev/null); then
>> -				fatal_error "loop device setup unsuccessful!" \
>> -				            "try calling '$sudo_command' with root" \
>> -				            "permissions manually."
>> -			fi
>> -		fi
>> -		KAS_WITH_LOOP_DEV="--device ${KAS_LOOP_DEV}"
>> +	--isar-rootless)
>> +		BUILD_SYSTEM="isar-rootless"
>>   		shift 1
>>   		;;
>> -	--runtime-args|--docker-args)
>> -		[ $# -gt 0 ] || usage
>> -		KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} $2"
>> +	--runtime-args | --docker-args)
>> +		[ $# -gt 1 ] || usage
>> +		KAS_EXTRA_RUNTIME_ARGS="${KAS_EXTRA_RUNTIME_ARGS} $2"
>>   		shift 2
>>   		;;
>>   	--ssh-dir)
>> -		[ $# -gt 2 ] || usage
>> +		[ $# -gt 1 ] || usage
>>   		KAS_SSH_DIR="$2"
>>   		shift 2
>>   		;;
>> @@ -408,15 +362,22 @@ while [ $# -gt 0 ]; do
>>   		shift 1
>>   		;;
>>   	--aws-dir)
>> -		[ $# -gt 2 ] || usage
>> +		[ $# -gt 1 ] || usage
>>   		KAS_AWS_DIR="$2"
>>   		shift 2
>>   		;;
>>   	--git-credential-store)
>> -		[ $# -gt 2 ] || usage
>> +		[ $# -gt 1 ] || usage
>>   		KAS_GIT_CREDENTIAL_STORE="$2"
>>   		shift 2
>>   		;;
>> +
>> +	--git-credential-socket)
>> +		[ $# -gt 1 ] || usage
>> +		KAS_GIT_CREDENTIAL_SOCKET="$2"
>> +		shift 2
>> +		;;
>> +
>>   	--no-proxy-from-env)
>>   		KAS_NO_PROXY_FROM_ENV=1
>>   		shift 1
>> @@ -446,19 +407,19 @@ while [ $# -gt 0 ]; do
>>   	--*)
>>   		usage
>>   		;;
>> -	clean|cleansstate|cleanall|purge)
>> +	clean | cleansstate | cleanall | purge)
>>   		KAS_REPO_MOUNT_OPT_DEFAULT="ro"
>>   		KAS_CMD=$1
>>   		shift 1
>>   		break
>>   		;;
>> -	shell|lock)
>> +	shell | lock)
>>   		KAS_REPO_MOUNT_OPT_DEFAULT="rw"
>>   		KAS_CMD=$1
>>   		shift 1
>>   		break
>>   		;;
>> -	build|checkout|for-all-repos|menu)
>> +	build | checkout | for-all-repos | menu)
>>   		KAS_REPO_MOUNT_OPT_DEFAULT="ro"
>>   		KAS_CMD=$1
>>   		shift 1
>> @@ -486,6 +447,10 @@ while [ $# -gt 0 ]; do
>>   	esac
>>   done
>>   
>> +KAS_RUNTIME_ARGS="--log-driver=none --user=root"
>> +
>> +setup_kas_dirs
>> +
>>   [ -n "${KAS_CMD}" ] || usage
>>   
>>   KAS_EXTRA_BITBAKE_ARGS=0
>> @@ -494,17 +459,17 @@ KAS_FILES=
>>   # parse kas sub-command options
>>   while [ $# -gt 0 ] && [ $KAS_EXTRA_BITBAKE_ARGS -eq 0 ]; do
>>   	case "$1" in
>> -	--format|--indent|--provenance|--skip|--target|--task)
>> +	--format | --indent | --provenance | --skip | --target | --task)
>>   		KAS_OPTIONS="${KAS_OPTIONS} $1 $2"
>>   		shift 1
>>   		shift 1 || KAS_OPTIONS="--help"
>>   		;;
>> -	-c|--cmd|--command)
>> +	-c | --cmd | --command)
>>   		KAS_BITBAKE_C_OPTION_ARGS="$2"
>>   		shift 1
>>   		shift 1 || KAS_OPTIONS="--help"
>>   		;;
>> -	-E|--preserve-env)
>> +	-E | --preserve-env)
>>   		fatal_error "$1 is not supported with ${KAS_CONTAINER_SELF_NAME}"
>>   		;;
>>   	--)
>> @@ -563,10 +528,10 @@ if [ "${KAS_CMD}" = "menu" ]; then
>>   	if [ "$(echo "${KAS_FIRST_FILES}" | wc -w)" -ne "1" ]; then
>>   		fatal_error "menu plugin only supports a single Kconfig file"
>>   	fi
>> -	BUILD_SYSTEM=$(tr '\n' '\f' 2>/dev/null < "${KAS_FIRST_FILES}" | \
>> +	BUILD_SYSTEM=${BUILD_SYSTEM:-$(tr '\n' '\f' 2>/dev/null < "${KAS_FIRST_FILES}" |
>>   		sed -e 's/\(.*\fconfig KAS_BUILD_SYSTEM\f\(.*\)\|.*\)/\2/' \
>>   		    -e 's/\f\([[:alpha:]].*\|$\)//' \
>> -		    -e 's/.*default \"\(.*\)\".*/\1/')
>> +		    -e 's/.*default \"\(.*\)\".*/\1/')}
>>   else
>>   	if [ -z "${KAS_FIRST_FILES}" ]; then
>>   		KAS_FIRST_FILES="${KAS_WORK_DIR}/.config.yaml"
>> @@ -574,20 +539,60 @@ else
>>   
>>   	# We only get the first build system and let kas check if mixed
>>   	_KAS_FIRST_FILE=$(echo "${KAS_FIRST_FILES}" | awk '{print $1}')
>> -	BUILD_SYSTEM=$(grep -e "^build_system: " "${_KAS_FIRST_FILE}" 2>/dev/null | \
>> -		sed 's/build_system:[ ]\+//')
>> +	BUILD_SYSTEM=${BUILD_SYSTEM:-$(grep -e "^build_system: " "${_KAS_FIRST_FILE}" 2>/dev/null |
>> +		sed 's/build_system:[ ]\+//')}
>>   fi
>>   
>> -if [ "${BUILD_SYSTEM}" = "isar" ]; then
>> +KAS_CONTAINER_ENGINE="${KAS_CONTAINER_ENGINE:-${KAS_DOCKER_ENGINE}}"
>> +if [ -z "${KAS_CONTAINER_ENGINE}" ]; then
>> +	# Try to auto-detect a container engine
>> +	# Defaults if there are multiple options:
>> +	# podman if build system is isar-rootless, docker otherwise
>> +	if [ "${BUILD_SYSTEM}" = "isar-rootless" ] && command -v podman >/dev/null 2>&1; then
>> +		KAS_CONTAINER_ENGINE=podman
>> +	elif command -v docker >/dev/null 2>&1 && docker -v 2>/dev/null | grep -q '^Docker'; then
>> +		KAS_CONTAINER_ENGINE=docker
>> +	elif command -v podman >/dev/null 2>&1; then
>> +		KAS_CONTAINER_ENGINE=podman
>> +	else
>> +		fatal_error "no container engine found, need docker or podman"
>> +	fi
>> +fi
>> +
>> +KAS_DOCKER_ROOTLESS=0
>> +case "${KAS_CONTAINER_ENGINE}" in
>> +docker)
>> +	KAS_CONTAINER_COMMAND="docker"
>> +	enable_unpriv_userns_docker
>> +	if [ "$(docker context show)" = "rootless" ]; then
>> +		KAS_DOCKER_ROOTLESS=1
>> +	fi
>> +	;;
>> +podman)
>> +	KAS_CONTAINER_COMMAND="podman"
>> +	KAS_RUNTIME_ARGS="${KAS_RUNTIME_ARGS} --security-opt label=disable"
>> +	;;
>> +*)
>> +	fatal_error "unknown container engine '${KAS_CONTAINER_ENGINE}'"
>> +	;;
>> +esac
>> +
>> +if [ "${BUILD_SYSTEM}" = "isar" ] || [ "${BUILD_SYSTEM}" = "isar-privileged" ]; then
>>   	enable_isar_mode
>> -elif [ -z "${ISAR_MODE}" ]; then
>> +elif [ "${BUILD_SYSTEM}" = "isar-rootless" ]; then
>> +	enable_isar_rootless_mode
>> +else
>>   	enable_oe_mode
>>   fi
>>   
>>   # clean can be executed without config, hence manually forward the build system
>> -if [ "${ISAR_MODE}" = "1" ] && echo "${KAS_CMD}" | grep -qe "^clean\|purge"; then
>> -	KAS_OPTIONS="${KAS_OPTIONS} --isar"
>> -fi
>> +case "${BUILD_SYSTEM}" in
>> +isar*)
>> +	if echo "${KAS_CMD}" | grep -qe "^clean\|purge"; then
>> +		KAS_OPTIONS="${KAS_OPTIONS} --${BUILD_SYSTEM}"
>> +	fi
>> +	;;
>> +esac
>>   
>>   set_container_image_var
>>   
>> @@ -628,10 +633,21 @@ forward_dir KAS_BUILD_DIR "/build" "rw"
>>   forward_dir DL_DIR "/downloads" "rw"
>>   forward_dir KAS_REPO_REF_DIR "/repo-ref" "rw"
>>   forward_dir SSTATE_DIR "/sstate" "rw"
>> +forward_dir BB_HASHSERVE_DB_DIR "/bb-hashserve-db" "rw"
>>   forward_dir KAS_BUILDTOOLS_DIR "/buildtools" "rw"
>>   
>>   if git_com_dir=$(git -C "${KAS_REPO_DIR}" rev-parse --git-common-dir 2>/dev/null) \
>>   	&& [ "$git_com_dir" != "$(git -C "${KAS_REPO_DIR}" rev-parse --git-dir)" ]; then
>> +
>> +	KAS_GIT_OVERLAY_FILE=""
>> +	kas_container_cleanup()
>> +	{
>> +		if [ -f "${KAS_GIT_OVERLAY_FILE}" ]; then
>> +			trace rm -f "${KAS_GIT_OVERLAY_FILE}"
>> +		fi
>> +	}
>> +	trap kas_container_cleanup EXIT INT TERM
>> +
>>   	# If (it's a git repo) and the common dir isn't the git-dir, it is shared worktree and
>>   	# we have to mount the common dir in the container to make git work
>>   	# The mount path inside the container is different from the host path. Hence, we over-mount
>> @@ -685,6 +701,14 @@ if [ -n "${KAS_GIT_CREDENTIAL_STORE}" ] ; then
>>   	set -- "$@" -v "$(realpath -e "${KAS_GIT_CREDENTIAL_STORE}")":/var/kas/userdata/.git-credentials:ro
>>   fi
>>   
>> +if [ -n "${KAS_GIT_CREDENTIAL_SOCKET}" ] ; then
>> +	if [ ! -S "${KAS_GIT_CREDENTIAL_SOCKET}" ]; then
>> +		fatal_error "passed KAS_GIT_CREDENTIAL_SOCKET '${KAS_GIT_CREDENTIAL_SOCKET}' is not a socket"
>> +	fi
>> +	KAS_GIT_CREDENTIAL_HELPER_DEFAULT="cache --socket=/var/kas/userdata/.git-cache-socket"
>> +	set -- "$@" -v "$(realpath -e "${KAS_GIT_CREDENTIAL_SOCKET}")":/var/kas/userdata/.git-cache-socket
>> +fi
>> +
>>   GIT_CREDENTIAL_HELPER="${GIT_CREDENTIAL_HELPER:-${KAS_GIT_CREDENTIAL_HELPER_DEFAULT}}"
>>   
>>   if [ -n "${GIT_CREDENTIAL_HELPER}" ] ; then
>> @@ -731,6 +755,7 @@ fi
>>   for var in TERM KAS_DISTRO KAS_MACHINE KAS_TARGET KAS_TASK KAS_CLONE_DEPTH \
>>              KAS_PREMIRRORS DISTRO_APT_PREMIRRORS BB_NUMBER_THREADS PARALLEL_MAKE \
>>              GIT_CREDENTIAL_USEHTTPPATH \
>> +           BB_HASHSERVE BB_HASHSERVE_UPSTREAM \
>>              TZ; do
>>   	if [ -n "$(eval echo \$${var})" ]; then
>>   		set -- "$@" -e "${var}=$(eval echo \"\$${var}\")"
>> @@ -739,7 +764,7 @@ done
>>   
>>   # propagate only supported SHELL settings
>>   case "$SHELL" in
>> -/bin/sh|/bin/bash|/bin/dash)
>> +/bin/sh | /bin/bash | /bin/dash)
>>   	set -- "$@" -e "SHELL=$SHELL"
>>   	;;
>>   *)
>> @@ -757,7 +782,7 @@ fi
>>   
>>   # SC2086: Double quote to prevent globbing and word splitting.
>>   # shellcheck disable=2086
>> -set -- "$@" ${KAS_ISAR_ARGS} ${KAS_WITH_LOOP_DEV} ${KAS_RUNTIME_ARGS} \
>> +set -- "$@" ${KAS_ISAR_ARGS} ${KAS_RUNTIME_ARGS} ${KAS_EXTRA_RUNTIME_ARGS} \
>>       ${KAS_CONTAINER_IMAGE} ${KAS_OPTIONS_DIRECT} ${KAS_CMD} ${KAS_OPTIONS}
>>   if [ -n "${KAS_BITBAKE_C_OPTION_ARGS}" ]; then
>>   	set -- "$@" -c "${KAS_BITBAKE_C_OPTION_ARGS}"
> 
> This is not kas-container from the 5.4 release.

Uups that was from next - will fix in v2.

Quirin
> 
> Jan
>