Re: [meta-virtualization] [PATCH v2 00/13] Container Improvements

Thanks Tim,

I'm out of the office for the next 1.5 weeks. so it will likely be
after that before I look into this in any detail.

Bruce


On Mon, Jul 6, 2026 at 1:13=E2=80=AFPM Tim Orling via lists.yoctoproject.or=
g
<[email protected]> wrote:
>
> This series:
>   * Sets OCI_IMAGE_RUNTIME_UID with ??=3D weak assignment in
>     image-oci to allow container-nonroot-user to set a different
>     default
>   * Adds a class to create/run containers with a non-root user
>   * Adds a class to create non-volatile var log and tmp directories
>   * Adds a class to enable 'dev' mode where the container starts as
>     the root user
>   * Adds new containers:
>     - app-container-python
>     - app-containter-mosquitto
>     - app-container-valkey
>     - app-container-nginx
>   * Modifies app-container-curl to be more like the upstream
>     experience (and more like the above containers)
>   * Allows mosquitto and libwebsockets to be parsed for
>     vcontainer distro so we can build multiarch containers
>     for app-container-mosquitto.
>   * Allows meta-webserver/recipes-httpd/nginx to be parsed for
>     vcontainer distro so we can build multiarch containers
>     for app-container-nginx.
>   * Adds a fix for buildbot-venv shadowing for environment-setup-ci
>     script
>
> The resulting containers were tested with simple command line
> usage compared to Docker provided equivalents to ensure the
> same expected behavior.
>
> Changes in v2:
>
>   There were a fair number of changes in v2 in reponse to review
>   comments and observations during testing.
>
>   * image-oci.bbclass:
>     - set OCI_IMAGE_RUNTIME_UID with ??=3D to allow other classes
>       to override
>   * container-nonroot-user.bbclass:
>     - set EXTRA_USERS_PARAMS with +=3D
>     - added comments to clarify the PYEOF Python heredoc behavior
>     - added logic to detect $image_name/index.json and fail if not
>       found
>   * container-volatile-fixup.bbclass: avoid repeating the same
>     rootfs postfunc by adding a helper class
>   * container-dev-mode.bbclass: avoid repeating the same logic
>     to run container as root user in '-dev' mode
>   * app-container-python (and other container image recipes):
>     - drop now redundant IMAGE_INSTALL lines
>     - simplify by inheriting container-volatile-fixup
>     - inherit container-dev-mode
>   * app-container-mosquitto:
>     - verify '-dev' mode switches from root user to mosquitto user
>     - verify "production" mode runs as 'nonroot' user
>     - fix bbmask to allow mosquitto and required libwebsockets
>   * app-container-valkey:
>     - added tini and container-entrypoint.sh, like upstream containers
>   * app-container-nginx:
>     - fixup 'nonroot' user ownership of NONROOT_OWNED_DIRS
>     - fix bbmask to allow nginx (but not other recipes-httpd)
>   * fix for older distro hosts where the 'websockets' Python library is
>     not new enough (>10.0) and on the AutoBuilder needs to use 'buildtool=
s'.
>     The PATH in environment-setup-ci now plays properly with such a set u=
p
>     by no longer added /usr/bin and /bin before existing $PATH.
>
> Successful build https://autobuilder.yoctoproject.org/valkyrie/#/builders=
/117/builds/25
>
> Tim Orling (13):
>   image-oci: set OCI_IMAGE_RUNTIME_UID with ??=3D
>   classes: add container-nonroot-user.bbclass
>   classes: add container-volatile-fixup.bbclass
>   classes: add container-dev-mode.bbclass
>   recipes-containers/images: add app-container-python
>   recipes-containers/images: add app-container-mosquitto
>   vcontainer-bbmask.inc: allow 'mosquitto', 'libwebsockets'
>   recipes-containers/images: add app-container-valkey
>   recipes-containers/images: add app-container-nginx
>   vcontainer-bbmask.inc: allow meta-webserver/recipes-httpd/nginx
>   app-container-curl: use multilayer mode; container-nonroot-user
>   container-image-multiarch: add helper recipe
>   vcontainer-tarball: fix buildbot-venv shadowing
>
>  classes/container-dev-mode.bbclass            |  34 ++++
>  classes/container-nonroot-user.bbclass        | 155 ++++++++++++++++++
>  classes/container-volatile-fixup.bbclass      |   6 +
>  classes/image-oci.bbclass                     |   3 +-
>  conf/distro/include/vcontainer-bbmask.inc     |   6 +-
>  conf/layer.conf                               |   1 +
>  .../images/app-container-curl.bb              |  39 +++++
>  .../images/app-container-mosquitto.bb         |  43 +++++
>  .../images/app-container-nginx.bb             |  62 +++++++
>  .../images/app-container-python.bb            |  45 +++++
>  .../images/app-container-valkey.bb            |  71 ++++++++
>  .../container-entrypoint.sh                   |  18 ++
>  .../images/container-image-multiarch.bb       |  31 ++++
>  .../vcontainer/vcontainer-tarball.bb          |   4 +-
>  recipes-demo/images/app-container-curl.bb     |  46 ------
>  15 files changed, 512 insertions(+), 52 deletions(-)
>  create mode 100644 classes/container-dev-mode.bbclass
>  create mode 100644 classes/container-nonroot-user.bbclass
>  create mode 100644 classes/container-volatile-fixup.bbclass
>  create mode 100644 recipes-containers/images/app-container-curl.bb
>  create mode 100644 recipes-containers/images/app-container-mosquitto.bb
>  create mode 100644 recipes-containers/images/app-container-nginx.bb
>  create mode 100644 recipes-containers/images/app-container-python.bb
>  create mode 100644 recipes-containers/images/app-container-valkey.bb
>  create mode 100644 recipes-containers/images/app-container-valkey/contai=
ner-entrypoint.sh
>  create mode 100644 recipes-containers/images/container-image-multiarch.b=
b
>  delete mode 100644 recipes-demo/images/app-container-curl.bb
>
> This series can be found at
> https://github.com/moto-timo/meta-virtualization/tree/container-improveme=
nts-v2
>
> --
> 2.54.0
>
>
> -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-
> Links: You receive all messages sent to this group.
> View/Reply Online (#9924): https://lists.yoctoproject.org/g/meta-virtuali=
zation/message/9924
> Mute This Topic: https://lists.yoctoproject.org/mt/120143346/1050810
> Group Owner: [email protected]
> Unsubscribe: https://lists.yoctoproject.org/g/meta-virtualization/unsub [=
[email protected]]
> -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-
>


--=20
- Thou shalt not follow the NULL pointer, for chaos and madness await
thee at its end
- "Use the force Harry" - Gandalf, Star Trek II