Skip to content

Commit dbfe650

Browse files
raharperraharper
authored
feat: build stacker on Ubuntu 24.04 LTS (noble) (#644)
Fix build on Ubuntu 24.04 - install libsystem-dev for static libsystemd library - Use ppa:puzzleos/dev to pull in patched lxc 5.0.3 which includes liblxc.a in the lxc-dev package - Handle modifying kernel tunables for user-namespace and apparmor restrictions - Adjust Makefile to add -lsystemd to the libs when making stacker-dynamic, but omit the library when stacker-static is building built - Add default container policy to rfs if not already present - Fix whiteouts.bats test, don't quote the bsdtar | grep or we get command not found, further, check the grep return code, if it's 0, then we found the whiteout file in the tar and the test should fail. Fixes: #632 Signed-off-by: Ryan Harper <[email protected]>
1 parent 7b4a6e2 commit dbfe650

File tree

4 files changed

+94
-27
lines changed

4 files changed

+94
-27
lines changed

‎.github/workflows/build.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ on:
3232

3333
jobs:
3434
build:
35-
runs-on: ubuntu-22.04
35+
runs-on: ubuntu-24.04
3636
services:
3737
registry:
3838
image: ghcr.io/project-stacker/registry:2

‎Makefile

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
SHELL=/bin/bash
12
TOP_LEVEL := $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST)))))
23
BUILD_D = $(TOP_LEVEL)/.build
34
export GOPATH ?= $(BUILD_D)/gopath
@@ -77,6 +78,16 @@ stacker-cov: $(STAGE1_STACKER) $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapp
7778
--substitute VERSION_FULL=$(VERSION_FULL) \
7879
--substitute WITH_COV=yes
7980

81+
# On Ubuntu 24.04 the lxc package does not link against libsystemd so the pkg-config
82+
# below does list -lsystemd; we must add it to the list but only for stacker-dynamic
83+
ifeq ($(shell awk -F= '/VERSION_ID/ {print $$2}' /etc/os-release),"24.04")
84+
ifeq (stacker-dynamic,$(firstword $(MAKECMDGOALS)))
85+
LXC_WRAPPER_LIBS=-lsystemd
86+
else
87+
LXC_WRAPPER_LIBS=
88+
endif
89+
endif
90+
8091
stacker-static: $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper
8192
$(call build_stacker,,static_build,-extldflags '-static',stacker)
8293

@@ -91,7 +102,7 @@ stacker-dynamic: $(STACKER_DEPS) cmd/stacker/lxc-wrapper/lxc-wrapper
91102
$(call build_stacker,,,,stacker-dynamic)
92103

93104
cmd/stacker/lxc-wrapper/lxc-wrapper: cmd/stacker/lxc-wrapper/lxc-wrapper.c
94-
make -C cmd/stacker/lxc-wrapper LDFLAGS=-static LDLIBS="$(shell pkg-config --static --libs lxc) -lpthread -ldl" lxc-wrapper
105+
make -C cmd/stacker/lxc-wrapper LDFLAGS=-static LDLIBS="$(shell pkg-config --static --libs lxc) $(LXC_WRAPPER_LIBS) -lpthread -ldl" lxc-wrapper
95106

96107

97108
.PHONY: go-download

‎install-build-deps.sh

Lines changed: 78 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -22,27 +22,58 @@ installdeps_fedora() {
2222
}
2323

2424
installdeps_ubuntu() {
25-
sudo add-apt-repository -y ppa:project-machine/squashfuse
26-
sudo apt -yy install \
27-
build-essential \
28-
cryptsetup-bin \
29-
jq \
30-
libacl1-dev \
31-
libcap-dev \
32-
libcryptsetup-dev \
33-
libdevmapper-dev \
34-
libpam0g-dev \
35-
libseccomp-dev \
36-
libselinux1-dev \
37-
libssl-dev \
38-
libzstd-dev \
39-
lxc-dev \
40-
lxc-utils \
41-
parallel \
42-
pkg-config \
43-
squashfs-tools \
44-
squashfuse \
45-
libarchive-tools
25+
PKGS=(
26+
build-essential
27+
cryptsetup-bin
28+
jq
29+
libacl1-dev
30+
libcap-dev
31+
libcryptsetup-dev
32+
libdevmapper-dev
33+
liblxc-dev
34+
libpam0g-dev
35+
libseccomp-dev
36+
libselinux1-dev
37+
libssl-dev
38+
libzstd-dev
39+
lxc-dev
40+
lxc-utils
41+
parallel
42+
pkg-config
43+
squashfs-tools
44+
squashfuse
45+
libarchive-tools
46+
)
47+
48+
case "$VERSION_ID" in
49+
22.04)
50+
sudo add-apt-repository -y ppa:project-machine/squashfuse
51+
;;
52+
24.04)
53+
# lp:2080069
54+
# temporarily add puzzleos/dev to pickup lxc-dev package which
55+
# provides static liblxc.a
56+
sudo add-apt-repository -y ppa:puzzleos/dev
57+
58+
# allow array to expand again
59+
#shellcheck disable=2206
60+
PKGS=( ${PKGS[*]} libsystemd-dev )
61+
62+
# 24.04 has additional apparmor restrictions, probably doesn't apply
63+
# for root in github VM but developers will run into this
64+
enable_userns
65+
;;
66+
esac
67+
68+
# allow array to expand
69+
#shellcheck disable=2206
70+
sudo apt -yy install ${PKGS[*]}
71+
72+
# Work around an Ubuntu packaging bug. Fixed in 23.04 onward.
73+
if [ "$VERSION_ID" != "24.04" ]; then
74+
sudo sed -i 's/#define LXC_DEVEL 1/#define LXC_DEVEL 0/' /usr/include/lxc/version.h
75+
fi
76+
4677
# skopeo deps
4778
sudo apt -yy install \
4879
libgpgme-dev \
@@ -54,8 +85,24 @@ installdeps_ubuntu() {
5485
sudo apt -yy install golang-go
5586
go version
5687
fi
57-
# Work around an Ubuntu packaging bug. Fixed in 23.04 onward.
58-
sudo sed -i 's/#define LXC_DEVEL 1/#define LXC_DEVEL 0/' /usr/include/lxc/version.h
88+
}
89+
90+
enable_userns() {
91+
SYSCTL_USERNS="/etc/sysctl.d/00-enable-userns.conf"
92+
if ! [ -s "${SYSCTL_USERNS}" ]; then
93+
echo "Add kernel tunables to enable user namespaces in $SYSCTL_USERNS "
94+
cat <<EOF | sudo tee "${SYSCTL_USERNS}"
95+
kernel.apparmor_restrict_unprivileged_io_uring = 0
96+
kernel.apparmor_restrict_unprivileged_unconfined = 0
97+
kernel.apparmor_restrict_unprivileged_userns = 0
98+
kernel.apparmor_restrict_unprivileged_userns_complain = 0
99+
kernel.apparmor_restrict_unprivileged_userns_force = 0
100+
kernel.unprivileged_bpf_disabled = 2
101+
kernel.unprivileged_userns_apparmor_policy = 0
102+
kernel.unprivileged_userns_clone = 1
103+
EOF
104+
sudo sysctl -p /etc/sysctl.d/00-enable-userns.conf
105+
fi
59106
}
60107

61108
installdeps_golang() {
@@ -78,5 +125,13 @@ case $ID_LIKE in
78125
;;
79126
esac
80127

128+
# add container policy (if not already present
129+
POLICY="/etc/containers/policy.json"
130+
if ! [ -s "${POLICY}" ]; then
131+
sudo mkdir -p "$(dirname $POLICY)"
132+
echo "adding default containers policy (insecure):${POLICY}"
133+
echo '{"default":[{"type":"insecureAcceptAnything"}]}' | sudo tee "${POLICY}"
134+
fi
135+
81136
# install golang deps
82137
installdeps_golang || exit 1

‎test/whiteout.bats

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,9 @@ EOF
2727
continue
2828
}
2929
bsdtar -tvf oci/blobs/sha256/$f
30-
run "bsdtar -tvf oci/blobs/sha256/$f | grep '.wh.sensors.d'"
31-
if [ "$status" -eq 0 ]; then
30+
# we expect the grep to fail, if it returns success we fail the test since
31+
# it means we have .wh files in the tar which we should NOT.
32+
if run bsdtar -tvf oci/blobs/sha256/$f | grep '.wh.sensors.d'; then
3233
echo "should not have a sensors.d whiteout!";
3334
exit 1;
3435
fi

0 commit comments

Comments
 (0)