Re: Running an ostree deployment in a container

[Colin Walters <walters verbum org>]

On Fri, Apr 27, 2018, at 11:11 AM, Philip Withnall wrote:
> On Fri, 2018-04-27 at 09:45 -0500, Dan Nicholson wrote:
> > That is simpler :) We had some people at Endless that were using
> > nspawn for testng, but now I see that they're also working on full
> > bootable images. I think it will be difficult for nspawn to handle a
> > straight deployment directory since it's not actually runnable in the
> > normal sense. OSTree deployments kinda depend on an initramfs setting
> > up the mounts correctly so it looks like a normal root directory.
>
> I suspect I am one of the people at Endless being referred to here, and
> I’d like to clarify that I do still want to run OSTree images from
> nspawn for testing; but booting a VM makes more sense for other kinds
> of testing.

Yeah, I should have mentioned this; Philip at least was working on having
nspawn set up in such a way that one could actually use e.g. `ostree admin upgrade`
and similar things inside the container.  That's not something I've tried
to support with our bwrap usage...some investigation shows
https://github.com/projectatomic/bubblewrap/issues/182

In general for me, the fact that SELinux isn't containerized (and SELinux is
a must-have for Fedora plus the fact that it's a pain to test) has driven us
more towards the VM model.  Plus the fact that for testing ostree itself
we really want coverage of the stuff that's actually in the initramfs, kernel
interactions like the FIFREEZE usage, etc.