Re: [cip-dev][isar-cip-core][PATCH v2 5/5] update README.md for rootless build

On 28.07.26 17:32, Quirin Gylstorff wrote:
>=20
>=20
> On 7/28/26 5:25 PM, Jan Kiszka wrote:
>> On 28.07.26 15:12, Quirin Gylstorff wrote:
>>> Signed-off-by: Quirin Gylstorff <[email protected]>
>>> ---
>>> =C2=A0 README.md | 8 ++++----
>>> =C2=A0 1 file changed, 4 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/README.md b/README.md
>>> index 435d037..df1564f 100644
>>> --- a/README.md
>>> +++ b/README.md
>>> @@ -10,10 +10,10 @@ from scratch.
>>> =C2=A0 =C2=A0 ## Building Target Images
>>> =C2=A0 -Install docker or podman and make sure you have required
>>> permissions to start
>>> -privileged containers. For docker, you need to be part of respective
>>> docker
>>> -group (`sudo usermod -aG docker <USER>`). Privileged podman requires
>>> sudo
>>> -rights for the caller (`<USER> ALL=3D(root) SETENV: /usr/bin/podman`
>>> in sudoers).
>>> +Install docker or podman. For docker, you need to be part of
>>> respective docker
>>> +group (`sudo usermod -aG docker <USER>`). The build requires Debian
>>> Bullseye
>>
>> ...and docker will inherently remain not fully rootless (due to its
>> daemon concept). Therefore, we should strongly recommend podman here.
>>
>>> +(kernel version >=3D 5.10.1) or newer to support user namespaces for
>>> rootless builds.
>>
>> We need much fresher systems, already kernel ~6.7 for binfmt_misc
>> namespaces, at least when cross-building. Practically, I do not want to
>> debug ANY rootless build on anything older than trixie.
>>
> Proposal:
> ```
> Install docker or podman. For docker, you need to be part of respective
> docker
> group (`sudo usermod -aG docker <USER>`) as isar-cip-core uses isar-
> rootless and due
> to its daemon concept docker cannot be fully rootless it is recommeneded
> to use podman. The build requires Debian Trixie (kernel version >=3D 6.7)
> or newer to support user and binfmt namespaces for rootless builds.
> ```
>=20

I'm using now this:

Install docker or podman. For true unprivileged builds, podman is recommend=
ed.
For docker, you need to be part of respective docker group
(`sudo usermod -aG docker <USER>`). Rootless builds furthermore require a
host kernel version 6.7 or newer.

Jan

--=20
Siemens AG, Foundational Technologies
Linux Expert Center