linux-kernel - Re: [RFC PATCH 1/1] kbuild: add Makefile.container with CONTAINER option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251014170842.2fc00c88@nimda.home>
Date: Tue, 14 Oct 2025 17:08:42 +0300
From: Onur Özkan <work@...rozkan.dev>
To: Miguel Ojeda <miguel.ojeda.sandonis@...il.com>
Cc: Guillaume Tucker <gtucker@...cker.io>, Nathan Chancellor
 <nathan@...nel.org>, Nicolas Schier <nicolas.schier@...ux.dev>, Miguel
 Ojeda <ojeda@...nel.org>, rust-for-linux@...r.kernel.org,
 linux-kbuild@...r.kernel.org, linux-kernel@...r.kernel.org,
 automated-testing@...ts.yoctoproject.org, Arnd Bergmann <arnd@...db.de>,
 workflows@...r.kernel.org, llvm@...ts.linux.dev
Subject: Re: [RFC PATCH 1/1] kbuild: add Makefile.container with CONTAINER
 option

On Tue, 14 Oct 2025 13:58:10 +0200
Miguel Ojeda <miguel.ojeda.sandonis@...il.com> wrote:

> On Tue, Oct 14, 2025 at 11:45 AM Guillaume Tucker
> <gtucker@...cker.io> wrote:
> >
> > Add scripts/Makefile.container to wrap the make command in a
> > container using the CONTAINER= variable to specify the image name.
> > For example:
> >
> >     make -f scripts/Makefile.container CONTAINER=korg-gcc defconfig
> >
> > The container image name is entirely arbitrary and the container
> > tool may be Docker, Podman or any other compatible alternative
> > specified by the CONTAINER_COMMAND variable.  The default is set to
> > docker for now.
> 
> IIUC, this wraps reruns `make` inside the container, but it means
> hardcoding a particular tool and path, right? (unless one sets even
> more variables)
> 
> The cover letter says one can create an alias for this, but one could
> also do that for the underlying call anyway, unless I am missing
> something. And if we do this, then I would prefer one doesn't need to
> type `-f ...`.
> 
> Put another way, for a user, what is the benefit of having this extra
> way of running in a container? For instance, I could see the benefit
> if different tools had different flags or it was a complicated
> procedure, but I think at least `podman` shares the flags used here.
> 
> Should this instead be a document inside `Documentation/` somewhere
> that explains how to do this, pitfalls, advanced options, etc. and
> give example command lines for different tools?
> 
> If we do end up with `CONTAINER=`, then I think it should make it work
> without having to pass `-f ...`, to make it easier. Or, even better,
> like the KUnit script, we could have a script that does the right
> thing and reads a config from the user, so that one can just type
> something like, picking whatever tooling the user configured (e.g.
> Docker vs. Podman, default image, etc.):
> 
>     scripts/container.py defconfig
> 

I think this functionality would be better implemented as a script
(like you mentioned) rather than a Makefile. The current approach is
likely to run into several practical issues (e.g. file permission
mismatches between host and container, the need to manually remove
containers with `docker rm`, etc.) and addressing all of these
reliably in Makefile can become quite messy. Writing a python (or even
perl) script would make it much easier to maintain. Also, it can be
self-documented quite nicely with `scripts/container.py --help` command.

Regards,
Onur

> Thanks!
> 
> Cheers,
> Miguel