mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-26 15:55:24 +00:00
5b1ac36626
Add a self-contained "devkit" guest extension: a minimal Ubuntu (glibc + busybox + apt) rootfs with common debug tools prebaked (strace, ltrace, iproute2, procps, lsof, tcpdump, pciutils, util-linux, ...), built as a measured erofs+dm-verity image mounted at /run/kata-extensions/devkit. The production guest rootfs is minimal (and, for some bases, shell-less), so the agent debug console has no rich interactive shell. Rather than rebuilding the whole rootfs with debug tooling, this optional extension can be cold-plugged alongside any base image. At runtime the guest helper scripts overlay a writable tmpfs on the read-only extension and chroot in, so apt and every tool run natively against a normal root filesystem; `apt install <pkg>` inside the debug shell pulls anything else into the overlay on demand. busybox-static (/usr/bin/busybox.static) bootstraps the overlay/chroot from the shell-less base (the guest's dynamic loader is not present there yet); it is installed at a dedicated path so it never clobbers the extension's own busybox or /bin/sh, which are needed unclobbered inside the chroot. The rootfs is built through osbuilder (rootfs.sh, with a ROOTFS_ONLY mode that skips the agent/systemd setup) using mmdebstrap, the same tool the base guest rootfs uses, so the devkit needs no bespoke chroot or docker-export logic. The resulting tree is handed to image_builder.sh (mirroring the CoCo extension): it ships no kata-agent, kernel or driver userspace. No runtime wiring is added here; that follows in later commits. Nothing consumes the image yet. Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com> Assisted-by: Cursor <cursoragent@cursor.com>
43 lines
1.7 KiB
Bash
43 lines
1.7 KiB
Bash
#!/run/kata-extensions/devkit/bin/busybox.static sh
|
|
# shellcheck shell=dash
|
|
#
|
|
# Copyright (c) Kata Containers Community
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
#
|
|
# Interactive devkit debug shell: the debug_console_shell target, reached via
|
|
# ${DEVKIT}/bin/devkit-sh -> this.
|
|
#
|
|
# NOTE: the bootstrap busybox ash has no builtin/PATH `[`, so use "${BB}" test.
|
|
DEVKIT=/run/kata-extensions/devkit
|
|
# BB and MERGED are exported by the sourced devkit-init, resolved at runtime.
|
|
# shellcheck source=tools/osbuilder/rootfs-builder/devkit/devkit-init.sh
|
|
. "${DEVKIT}/usr/bin/devkit-init"
|
|
|
|
devkit_setup_chroot || {
|
|
"${BB}" echo "devkit: failed to set up chroot environment" >&2
|
|
exit 1
|
|
}
|
|
|
|
# Prefer the prebaked bash, falling back to busybox ash (/bin/sh) if bash is
|
|
# missing or not executable in the merged tree.
|
|
shell=/bin/bash
|
|
"${BB}" test -x "${MERGED}${shell}" || shell=/bin/sh
|
|
|
|
# The agent execs the shell with no arguments, so default to a login shell; any
|
|
# arguments (-i, -c "cmd", ...) pass straight through.
|
|
"${BB}" test "$#" -eq 0 && set -- -l
|
|
|
|
# Enter the chroot in a private UTS namespace whose hostname is "devkit", so the
|
|
# prompt makes the devkit overlay obvious without renaming the guest (the change
|
|
# is confined to this shell and gone once it exits). Setting the name is
|
|
# best-effort; fall back to a plain chroot if unshare is unavailable.
|
|
if "${BB}" test -x "${MERGED}/usr/bin/unshare"; then
|
|
# shellcheck disable=SC2016 # $@ must expand in the inner sh, not here
|
|
exec "${BB}" chroot "${MERGED}" /usr/bin/unshare --uts /bin/sh -c \
|
|
'echo devkit > /proc/sys/kernel/hostname 2>/dev/null || true; exec "$@"' \
|
|
devkit-enter "${shell}" "$@"
|
|
fi
|
|
|
|
exec "${BB}" chroot "${MERGED}" "${shell}" "$@"
|