NVIDIA / enroot

A simple yet powerful tool to turn traditional container/OS images into unprivileged sandboxes.
Apache License 2.0
648 stars 94 forks source link

Compilation issues in alpine container #133

Open jfolz opened 2 years ago

jfolz commented 2 years ago

Hello! I'm struggling getting enroot to compile in an alpine container (also enroot in case that makes a difference). Some advice would be much appreciated.

I've adapted the instructions so far:

apk add git gcc make libtool automake alpine-sdk libcap autoconf linux-headers tar bash
git clone --recurse-submodules https://github.com/NVIDIA/enroot.git
cd enroot
make install

Compilation gets underway, but there's an issue in the libbsd dependency:

libtool: compile:  /usr/bin/gcc -DHAVE_CONFIG_H -I.. -isystem ../include/bsd/ -include ../config.h -DLIBBSD_OVERLAY -DLIBBSD_DISABLE_DEPRECATED -D__REENTRANT -D_FORTIFY_SOURCE=2 -O2 -fdata-sections -ffunction-sections -fstack-protector -MT flopen.lo -MD -MP -MF .deps/flopen.Tpo -c flopen.c -fPIE -o flopen.o
flopen.c: In function 'vflopenat':
flopen.c:60:21: error: 'O_CREAT' undeclared (first use in this function)
   60 |         if (flags & O_CREAT) {
      |                     ^~~~~~~
flopen.c:60:21: note: each undeclared identifier is reported only once for each function it appears in
flopen.c:65:21: error: 'O_NONBLOCK' undeclared (first use in this function)
   65 |         if (flags & O_NONBLOCK)
      |                     ^~~~~~~~~~
flopen.c:68:26: error: 'O_TRUNC' undeclared (first use in this function)
   68 |         trunc = (flags & O_TRUNC);
      |                          ^~~~~~~
flopen.c:72:27: warning: implicit declaration of function 'openat'; did you mean 'flopenat'? [-Wimplicit-function-declaration]
   72 |                 if ((fd = openat(dirfd, path, flags, mode)) == -1)
      |                           ^~~~~~
      |                           flopenat
flopen.c: In function 'flopen':
flopen.c:130:25: error: 'AT_FDCWD' undeclared (first use in this function)
  130 |         ret = vflopenat(AT_FDCWD, path, flags, ap);
      |                         ^~~~~~~~

Adding #include <fcntl.h> to flopen.c lets libbsd compile.

However it seems like musl doesn't compile correctly now:

make[2]: Leaving directory '/enroot/deps/linux-headers'
touch linux-headers/.stamp
make[1]: Leaving directory '/enroot/deps'
/enroot/deps/dist/musl/bin/musl-gcc -std=c99 -O2 -fstack-protector -fPIE -pedantic -Wall -Wextra -Wcast-align -Wpointer-arith -Wmissing-prototypes -Wnonnull -Wwrite-strings -Wlogical-op -Wformat=2 -Wmissing-format-attribute -Winit-self -Wshadow -Wstrict-prototypes -Wunreachable-code -Wconversion -Wsign-conversion  -s -D_FORTIFY_SOURCE=2 -isystem /enroot/deps/dist/libbsd/include/bsd -DLIBBSD_OVERLAY  -Wl,-zrelro -Wl,-znow -Wl,-zdefs -Wl,--as-needed -Wl,--gc-sections -L/enroot/deps/dist/libbsd/lib  -pie -static-pie  bin/enroot-aufs2ovlfs.c  -lbsd -o bin/enroot-aufs2ovlfs
make: /enroot/deps/dist/musl/bin/musl-gcc: No such file or directory
make: *** [<builtin>: bin/enroot-aufs2ovlfs] Error 127

There don't appear to be any errors in the musl build log, but the dist folder is basically empty:

# ls -R deps/musl/dist/
deps/musl/dist/:
config.mak

I've attached the full build log: enroot-build-log.txt

jfolz commented 2 years ago

I've had another go from a fresh checkout. Since musl-gcc is available in the container I linked it to where the build process expects it:

mkdir -p /enroot/deps/dist/musl/bin/
ln -s /usr/bin/x86_64-alpine-linux-musl-gcc /enroot/deps/dist/musl/bin/musl-gcc

It appears to now build and install correctly, but the process is pretty hacky.

3XX0 commented 2 years ago

Yeah, right now the build vendors every dependencies including Musl. We also need to patch musl-gcc for static PIE. Is there any reason why you want to use the toolchain from the container rather than the one that is vendored with Enroot?

jfolz commented 2 years ago

No not really. Linking was just something easy I tried since the musl-gcc binary wasn't built (or at least not copied to the expected path).