Re: [meta-virtualization][PATCH 2/7] recipes-containers/images: add app-container-python

On 2026-06-12 10:57:38-07:00, Bruce Ashfield wrote:
> Hi Tim,
> 
> Just a couple of comments ...
> 
> On Fri, May 29, 2026 at 18:31 -0700, Tim Orling wrote:
> 
> > Add OCI container image recipe for Python to use as a base for
> > other Python app containers. The image uses multi-layer mode with
> > separate base, terminal and python layers.
> 
> [...]
> 
> > +OCI_LAYERS = "\
> > +    base:packages:base-files+base-passwd+netbase \
> > +    terminal:packages:ncurses-terminfo-base \
> > +    python:packages:python3+coreutils${@bb.utils.contains('PACKAGECONFIG', 'dev', '+python3-pip', '', d)} \
> > +"
> 
> I like this conditional. Putting the bb.utils.contains() directly inside
> the layer's package list (instead of duplicating the OCI_LAYERS
> declaration in two PACKAGECONFIG branches).
> 
> Worth calling out in our multi-layer mode docs as the recommended way
> to do conditional packages-per-layer. I'll do a patch for that.

Just capturing that conditional packages-per-layer docs merged in:
27e41b91 docs/container-bundling: refresh multi-layer mode section

> 
> > +# IMAGE_INSTALL triggers package builds via do_rootfs recrdeptask.
> > +# Even for multi-layer mode, list packages here to ensure they're built.
> > +# The PM will install them directly to layers from DEPLOY_DIR_IPK.
> > +# Note: IMAGE_ROOTFS is still created but ignored for packages layers.
> > +IMAGE_INSTALL = "base-files base-passwd netbase"
> > +IMAGE_INSTALL += "ncurses-terminfo-base"
> > +IMAGE_INSTALL += "python3 coreutils"
> > +IMAGE_INSTALL += "${@bb.utils.contains('PACKAGECONFIG', 'dev', 'python3-pip', '', d)}"
> 
> This is correct today but it doubles the source of truth. The packages
> listed in OCI_LAYERS:packages: and the packages listed in IMAGE_INSTALL
> have to be kept in sync.
> 
> If they drift (change OCI_LAYERS but forget IMAGE_INSTALL or vice
> versa), the build silently breaks at layer assembly time when the
> missing package isn't in DEPLOY_DIR_IPK.
> 
> Two paths I'd consider, either as part of this series or as a follow-up:
> 
>   a) Add a "# KEEP IN SYNC WITH OCI_LAYERS" comment so the next
>      maintainer knows.
> 
>   b) Better: derive IMAGE_INSTALL from OCI_LAYERS:packages: layers
>      inside image-oci.bbclass, so the recipe only sets it once. That
>      fixes the problem for every multi-layer recipe, not just python.
> 
> I've staged b) on master-next (shortly), if you can do a) .. or maybe
> it isn't needed at all now.

Option b) was merged in:
5470cd0a image-oci: auto-derive IMAGE_INSTALL from OCI_LAYERS packages layers

I don't think a) is needed anymore, since b) is proven to be working

Refactored to remove the redundant/brittle IMAGE_INSTALL in v2.

> 
> We can do the same for all the other similar recipes in the series.

Other similar recipes addressed in v2.

> 
> One more, also non-blocking — the other 4 new image recipes in this
> series (mosquitto, valkey, nginx, curl) all carry the
> rootfs_fixup_var_volatile postprocess to create /var/volatile/{tmp,log}.
> 
> This one doesn't. Intentional because python doesn't touch /var/log? Or
> worth adding for consistency in case someone runs as 'dev' and pip
> wants a writable spot?

Added rootfs_fixup_var_volatile via 'inherit container-volatile-fixup'
in v2.

> 
> Bruce