Re: [cip-dev][isar-cip-core][PATCH v2 5/5] update README.md for rootless build

On 29.07.26 13:37, Moessbauer, Felix (FT RPD CED OES-DE) wrote:
> On Tue, 2026-07-28 at 18:55 +0200, Jan Kiszka wrote:
>> On 28.07.26 17:32, Quirin Gylstorff wrote:
>>>
>>>
>>> On 7/28/26 5:25 PM, Jan Kiszka wrote:
>>>> On 28.07.26 15:12, Quirin Gylstorff wrote:
>>>>> Signed-off-by: Quirin Gylstorff <[email protected]>
>>>>> ---
>>>>> =C2=A0 README.md | 8 ++++----
>>>>> =C2=A0 1 file changed, 4 insertions(+), 4 deletions(-)
>>>>>
>>>>> diff --git a/README.md b/README.md
>>>>> index 435d037..df1564f 100644
>>>>> --- a/README.md
>>>>> +++ b/README.md
>>>>> @@ -10,10 +10,10 @@ from scratch.
>>>>> =C2=A0 =C2=A0 ## Building Target Images
>>>>> =C2=A0 -Install docker or podman and make sure you have required
>>>>> permissions to start
>>>>> -privileged containers. For docker, you need to be part of respective
>>>>> docker
>>>>> -group (`sudo usermod -aG docker <USER>`). Privileged podman requires
>>>>> sudo
>>>>> -rights for the caller (`<USER> ALL=3D(root) SETENV: /usr/bin/podman`
>>>>> in sudoers).
>>>>> +Install docker or podman. For docker, you need to be part of
>>>>> respective docker
>>>>> +group (`sudo usermod -aG docker <USER>`). The build requires Debian
>>>>> Bullseye
>>>>
>>>> ...and docker will inherently remain not fully rootless (due to its
>>>> daemon concept). Therefore, we should strongly recommend podman here.
>>>>
>>>>> +(kernel version >=3D 5.10.1) or newer to support user namespaces for
>>>>> rootless builds.
>>>>
>>>> We need much fresher systems, already kernel ~6.7 for binfmt_misc
>>>> namespaces, at least when cross-building. Practically, I do not want t=
o
>>>> debug ANY rootless build on anything older than trixie.
>>>>
>>> Proposal:
>>> ```
>>> Install docker or podman. For docker, you need to be part of respective
>>> docker
>>> group (`sudo usermod -aG docker <USER>`) as isar-cip-core uses isar-
>>> rootless and due
>>> to its daemon concept docker cannot be fully rootless it is recommenede=
d
>>> to use podman. The build requires Debian Trixie (kernel version >=3D 6.=
7)
>>> or newer to support user and binfmt namespaces for rootless builds.
>>> ```
>>>
>>
>> I'm using now this:
>>
>> Install docker or podman. For true unprivileged builds, podman is recomm=
ended.
>> For docker, you need to be part of respective docker group
>> (`sudo usermod -aG docker <USER>`). Rootless builds furthermore require =
a
>=20
> This is dangerous, as being part of the docker group essentially means
> you're root (without password). It also is not any different from "sudo
> docker". For rootless docker, please refer to
> https://docs.docker.com/engine/security/rootless/
>=20

Valid point, and I think we would document that setup with more details
elsewhere, just linking that here afterwards. The kas docs are likely
the best place for these docker complications.

Jan

--=20
Siemens AG, Foundational Technologies
Linux Expert Center