mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-26 15:55:24 +00:00
5b1ac36626
Add a self-contained "devkit" guest extension: a minimal Ubuntu (glibc + busybox + apt) rootfs with common debug tools prebaked (strace, ltrace, iproute2, procps, lsof, tcpdump, pciutils, util-linux, ...), built as a measured erofs+dm-verity image mounted at /run/kata-extensions/devkit. The production guest rootfs is minimal (and, for some bases, shell-less), so the agent debug console has no rich interactive shell. Rather than rebuilding the whole rootfs with debug tooling, this optional extension can be cold-plugged alongside any base image. At runtime the guest helper scripts overlay a writable tmpfs on the read-only extension and chroot in, so apt and every tool run natively against a normal root filesystem; `apt install <pkg>` inside the debug shell pulls anything else into the overlay on demand. busybox-static (/usr/bin/busybox.static) bootstraps the overlay/chroot from the shell-less base (the guest's dynamic loader is not present there yet); it is installed at a dedicated path so it never clobbers the extension's own busybox or /bin/sh, which are needed unclobbered inside the chroot. The rootfs is built through osbuilder (rootfs.sh, with a ROOTFS_ONLY mode that skips the agent/systemd setup) using mmdebstrap, the same tool the base guest rootfs uses, so the devkit needs no bespoke chroot or docker-export logic. The resulting tree is handed to image_builder.sh (mirroring the CoCo extension): it ships no kata-agent, kernel or driver userspace. No runtime wiring is added here; that follows in later commits. Nothing consumes the image yet. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com> Assisted-by: Cursor <cursoragent@cursor.com>
37 lines
1.5 KiB
Bash
37 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
#
|
|
# Copyright (c) Kata Containers Community
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Variables are consumed externally by the osbuilder rootfs build system.
|
|
# shellcheck disable=SC2034
|
|
|
|
OS_NAME=ubuntu
|
|
# Ubuntu code name (e.g. "noble"), passed down from the guest image release so
|
|
# the devkit matches the base userspace ABI (glibc).
|
|
OS_VERSION=${OS_VERSION:-""}
|
|
[[ -z "${OS_VERSION}" ]] && echo "OS_VERSION is required, but was not set" && exit 1
|
|
|
|
# Debug tools prebaked so the extension works offline; `apt install <pkg>` pulls
|
|
# anything else on demand inside the overlay. apt itself is not in the "required"
|
|
# priority set mmdebstrap installs, so it is listed explicitly (it also pulls
|
|
# gpgv for repo verification). busybox-static bootstraps the overlay/chroot from
|
|
# the shell-less guest base (see devkit-init.sh); pciutils and util-linux inspect
|
|
# the guest's devices and namespaces from the chroot. Kept lean: heavier tools
|
|
# are pulled on demand.
|
|
PACKAGES="apt busybox-static bash ca-certificates strace ltrace iproute2 procps psmisc lsof tcpdump curl wget file less netcat-openbsd dnsutils pciutils util-linux"
|
|
|
|
# ltrace and busybox-static live in universe.
|
|
REPO_COMPONENTS=${REPO_COMPONENTS:-"main universe"}
|
|
|
|
# shellcheck disable=SC2154
|
|
case "${ARCH}" in
|
|
aarch64) DEB_ARCH=arm64;;
|
|
ppc64le) DEB_ARCH=ppc64el;;
|
|
s390x) DEB_ARCH="${ARCH}";;
|
|
x86_64) DEB_ARCH=amd64; REPO_URL=${REPO_URL_X86_64:-${REPO_URL:-http://archive.ubuntu.com/ubuntu}};;
|
|
*) die "${ARCH} not supported"
|
|
esac
|
|
REPO_URL=${REPO_URL:-http://ports.ubuntu.com}
|