[PATCH 1/1] kas-container(isar): emit warning if binfmt_misc cannot be mounted

[Felix Moessbauer]

This is needed for non-native builds (both in privileged and rootless
mode). While it usually is available in privileged mode, rootless mode
requires binfmt_misc namespacing, which requires at least kernel 6.7 or
backports of that feature.

We only emit a warning if not available, as native builds are unaffected.
By that, we also keep the error behavior similar to the aufs check.

Signed-off-by: Felix Moessbauer <felix.mo...@siemens.com>
---
container-entrypoint | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/container-entrypoint b/container-entrypoint
index 4876386e7..d04c1f1d5 100755
--- a/container-entrypoint
+++ b/container-entrypoint
@@ -25,7 +25,16 @@
enable_qemu_binfmts()
{
if ! [ -f /proc/sys/fs/binfmt_misc/status ]; then
- sudo mount -t binfmt_misc null /proc/sys/fs/binfmt_misc
+ if ! sudo mount -t binfmt_misc null /proc/sys/fs/binfmt_misc 2>/dev/null; then
+ cat <<EOF >&2
+WARNING: Cannot mount binfmt_misc, QEMU emulation will not work!
+
+Either your kernel does not support binfmt_misc, or it is not enabled.
+By that, you won't be able to build images for other architectures than the host's.
+
+EOF
+ return
+ fi
fi
for CONF in /usr/lib/binfmt.d/qemu-*.conf; do
if ! [ -f /proc/sys/fs/binfmt_misc/"$(basename "${CONF%%.conf}")" ]; then
--
2.53.0

[Jan Kiszka]

Nope, we want to fail, see my other patch. No one will read this when
the warning flood comes through, specifically due to the futile
configuration attempts below.

Jan

--
Siemens AG, Foundational Technologies
Linux Expert Center

[Jan Kiszka]

And there is another reason why we do not want to permit only native
builds on historic kernels: For unshare, we are relying on kernel
support that I do not want to qualify on too old kernels anymore. 6.7 is
at least reasonably fresh to draw an effective line over it.