New Package Request: app-emulation/qemu static-user amd64 binary translation on the arm64 image

[pothos]

Package name and purpose

The qemu package provides, besides the KVM-based emulation, a set of binaries that can be used to register a binary translator for ELF files of foreign architectures. By pre-loading the binary translator at startup any container image of the foreign architecture can be run. This helps arm64 nodes in a hybrid cluster where multiarch container images or node selectors for the pods are missing and a performance miss is acceptable.

• Package upstream repo and ebuild: see https://packages.gentoo.org/packages/app-emulation/qemu (flag static-user)

Impact of adding this package to the Flatcar OS image

• [x] This package meets the requirements of Flatcar Container Linux’ new package guidelines: https://github.com/flatcar-linux/Flatcar/blob/master/adding-new-packages.md

• The package improves on the following core values:

  • [ ] Secure by default: Doesn't decrease the security
  • [ ] Always up to date
  • [x] Improve container experience
  • [x] Operate at scale / automation / telemetry

The package will increase the OS image by: ~5 MBytes.

The package will potentially increase Flatcar’s attack surface:

• no, binary translation runs with the same privileges as the process that is run

Benefits of adding this package to the Flatcar OS image Supporting binary translation makes most sense for the arm64 image because amd64 container images are dominant.

Adding the arm64 translation binary to the amd64 image is also reasonable as it helps in the reverse direction (and also helps for cross compilation like we use it to build the arm64 images) but it's not as important.

Additional information We already build the binaries for the SDK but don't include them in the final image.

[pothos]

Or alternative suggestion, provide the binaries and the binfmt entry as release artifact so that they can be included via Ignition more easily? Then we can add it to the docs and make binary translation a conscious decision.

[pothos]

For amd64 the file /usr/lib/binfmt.d/qemu-x86_64-static.conf (or /etc/binfmt.d/…) is:

:qemu-x86_64:M::\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x3e\x00:\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff:/usr/bin/qemu-x86_64-static:F

[pothos]

New idea, make this a sysext image?