[PATCH v4 1/2] container-entrypoint: add builder user to the GID of kvm device

[Jose Quaresma]

The use case is for running OE-core runqemu and testimage inside the
container. OE-core builds qemu-system-native to use in runqemu which
in turn is used by testimage. The testimage bbclass provides the
OE-core infrastructure for testing and validation of the runtime
target images produced.

The OE-core runqemu helper works out of the box in kas-container
without kvm but the difference in speed is considerable.

Grant the build user access to /dev/kvm if requested. The device is
passed with its host GID, which won't match any container group, so
create/point a group at that GID and add builder to it. gosu picks up
supplementary groups.

Build a new container image to add the group the group only solves
part of the problem because the important point here is to map the
device gid from the host inside the container. Since the device is
bind mounted, the gid inside container is the same one outside it.
If the gid already exists within the container, then we will be added
to that pre-existing group.

Signed-off-by: Jose Quaresma <jose.q...@oss.qualcomm.com>
---

v4: fix kvm_grp variable
v3: remove KAS_ENABLE_KVM, rename variable and add comments
v2: add use case description and clarify the implementation
description.

container-entrypoint | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)

diff --git a/container-entrypoint b/container-entrypoint
index 0725a8c..9086346 100755
--- a/container-entrypoint
+++ b/container-entrypoint
@@ -104,6 +104,29 @@ restore_managed_dirs_owner()
chown_managed_dirs 0 0
}

+# Grant the build user access to /dev/kvm if requested. The device is
+# passed with its host GID, which won't match any container group, so
+# create/point a group at that GID and add builder to it. gosu picks up
+# supplementary groups, so no host-side permission change is needed.
+add_kvm_group_id()
+{
+ if [ -c /dev/kvm ]; then
+ # get numeric group ID of the device
+ DEV_GID_NUM="$(stat -c '%g' /dev/kvm)"
+ # checks if there is any group with that numeric ID
+ DEV_GID_NAME="$(getent group "$DEV_GID_NUM" | cut -d: -f1)"
+ # We already have a group with that numeric ID?
+ if [ -z "$DEV_GID_NAME" ]; then
+ # There is no group with this numeric ID, so let's create it
+ DEV_GID_NAME=hostkvm
+ groupadd --non-unique --gid "$DEV_GID_NUM" "$DEV_GID_NAME"
+ fi
+ # Finally, added the user 'builder' to the group with the numeric ID
+ # of the device /dev/kvm provided by the host machine
+ usermod --append --groups "$DEV_GID_NAME" builder
+ fi
+}
+
if mount | grep -q "on / type aufs"; then
cat <<EOF >&2
WARNING: Generation of wic images will fail!
@@ -139,6 +162,7 @@ else

groupmod -o --gid "$GROUP_ID" builder
usermod -o --uid "$USER_ID" --gid "$GROUP_ID" builder >/dev/null
+ add_kvm_group_id
chown -R "$USER_ID":"$GROUP_ID" /builder
# copy host SSH config into home of builder
if [ -d /var/kas/userdata/.ssh ]; then
--
2.55.0

[Jose Quaresma]

Pass /dev/kvm into the container (for runqemu/testimage KVM acceleration)
and grant the build user access to it.

Signed-off-by: Jose Quaresma <jose.q...@oss.qualcomm.com>
---

v4: fix kvm_grp variable
v3: remove KAS_ENABLE_KVM, rename variable and add comments
v2: add use case description and clarify the implementation
description.

kas-container | 14 ++++++++++++++
1 file changed, 14 insertions(+)

diff --git a/kas-container b/kas-container
index 55bdcfc..d00dc93 100755
--- a/kas-container
+++ b/kas-container
@@ -70,6 +70,8 @@ usage()
"To force the use\n"
printf "%b" "\t\t\tof run0 over sudo, set KAS_SUDO_CMD=run0.\n"
printf "%b" "--isar-rootless\t\tRun an Isar build in rootless mode.\n"
+ printf "%b" "--kvm\t\tPass /dev/kvm into the container (for runqemu/testimage KVM\n" \
+ "acceleration) and grant the build user access to it."
printf "%b" "--runtime-args\t\tAdditional arguments to pass to the " \
"container runtime.\n"
printf "%b" "\t\t\tfor running the build.\n"
@@ -344,6 +346,10 @@ while [ $# -gt 0 ]; do
BUILD_SYSTEM="isar-rootless"
shift 1
;;
+ --kvm)
+ KAS_KVM="1"
+ shift 1
+ ;;
--runtime-args | --docker-args)
[ $# -gt 1 ] || usage
KAS_EXTRA_RUNTIME_ARGS="${KAS_EXTRA_RUNTIME_ARGS} $2"
@@ -691,6 +697,14 @@ if [ -n "${AWS_WEB_IDENTITY_TOKEN_FILE}" ] ; then
-e AWS_ROLE_ARN="${AWS_ROLE_ARN}"
fi

+if [ -n "${KAS_KVM}" ]; then

+ if [ -c /dev/kvm ]; then

+ set -- "$@" --device=/dev/kvm
+ else
+ warning "--kvm given but /dev/kvm not present on host; skipping"
+ fi
+fi
+
KAS_GIT_CREDENTIAL_HELPER_DEFAULT=""

if [ -n "${KAS_GIT_CREDENTIAL_STORE}" ] ; then
--
2.55.0

[Jan Kiszka]

Not sure if you tested it with podman as well: It happens to work, but
builder now joins the nogroup that /dev/kvm has here. So, it works there
as well.

Thanks, both applied

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center

[Jose Quaresma]

I have valited only on docker, good to know that it also works with podman.

Thanks

Jose