linux-kernel - Re: [PATCH v3 2/2] Documentation: dev-tools: add container.rst page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e96a6e71-80b3-4556-a4eb-fd242e0f5713@gtucker.io>
Date: Wed, 21 Jan 2026 10:55:53 +0100
From: Guillaume Tucker <gtucker@...cker.io>
To: Nathan Chancellor <nathan@...nel.org>, Miguel Ojeda <ojeda@...nel.org>,
 David Gow <davidgow@...gle.com>, Onur Özkan
 <work@...rozkan.dev>, Arnd Bergmann <arnd@...db.de>,
 linux-kernel@...r.kernel.org, rust-for-linux@...r.kernel.org,
 linux-kbuild@...r.kernel.org, automated-testing@...ts.yoctoproject.org,
 workflows@...r.kernel.org, llvm@...ts.linux.dev
Subject: Re: [PATCH v3 2/2] Documentation: dev-tools: add container.rst page

On 20/01/2026 7:35 pm, Nathan Chancellor wrote:
> On Tue, Jan 20, 2026 at 02:53:33PM +0100, Nicolas Schier wrote:
>> I probably have just read it over: I have to prefix the
>> 'tuxmake/korg-clang' by 'docker.io/'.  Is that a problem of my system
>> configuration (Debian forky, no special podman config)?
> 
> Some distributions ship registries.conf [1] to allow unqualified image
> names but I do not think Debian does. Personally, I use the full name
> regardless but it should be easy to create it for commands such as these
> to work. I use:
> 
> unqualified-search-registries = ['docker.io', 'ghcr.io', 'quay.io']
> 
> [1]: https://podman.io/docs/installation#registriesconf

And this is not directly related to the scripts/container tool as it
just passes the image name as-is.  Maybe the example in the docs
should explicitly use docker.io/ though.

>> I tested a tiny bit with podman as runtime backend.  If I leave out the
>> '-r podman' podman's docker emulation is in effect and fails with:
>>
>>      $ scripts/container -i docker.io/tuxmake/korg-clang -- make LLVM=1 -j8 olddefconfig
>>      Emulate Docker CLI using podman. Create /etc/containers/nodocker to quiet msg.
>>      mkdir: cannot create directory '.tmp_15': Permission denied
>>      mkdir: cannot create directory '.tmp_19': Permission denied
>>      mkdir: cannot create directory '.tmp_22': Permission denied
>>      mkdir: cannot create directory '.tmp_25': Permission denied
>>      mkdir: cannot create directory '.tmp_28': Permission denied
>>      mkdir: cannot create directory '.tmp_31': Permission denied
>>        HOSTCC  scripts/basic/fixdep
>>      error: error opening 'scripts/basic/.fixdep.d': Permission denied
>>      1 error generated.
>>      make[2]: *** [scripts/Makefile.host:114: scripts/basic/fixdep] Error 1
>>      make[1]: *** [/src/Makefile:655: scripts_basic] Error 2
>>      make: *** [Makefile:248: __sub-make] Error 2
>>      [exit code 2]
>>
>> But with '-r podman' it works like a charm.
>>
>> Would it make sense to switch the default runtime to podman to
>> prevent non-functional podman-docker emulation?  (Or is this just a
>> problem on my machine?)
> 
> Yeah, I think it would be better to prefer podman over docker if both
> existed on the system. Something like this should do that?
> 
> diff --git a/scripts/container b/scripts/container
> index dbe92630f05b..50c4ae851001 100755
> --- a/scripts/container
> +++ b/scripts/container
> @@ -105,7 +105,7 @@ class PodmanRuntime(CommonRuntime):
>   class Runtimes:
>       """List of all supported runtimes"""
>   
> -    runtimes = [DockerRuntime, PodmanRuntime]
> +    runtimes = [PodmanRuntime, DockerRuntime]
>   
>       @classmethod
>       def get_names(cls):

Yes this should do the trick, although the help message and docs
would need to be updated too.

A better way still would be to make it able to distinguish between
actual Docker and docker-compatible Podman (e.g. if it's just a
symlink) so it's not just down to luck.  This may be added to the
list of potential improvements.

Feel free to make these tweaks now, or we might wait a bit to see if
others have more feedback with further changes and I can send a v4.

Cheers,
Guillaume