codemods / builders as containers

[jelmer]

For practical purposes, it would be great if we could ship codemods as containers. This is tricky though, since it requires running docker-in-docker (or podman-in-podman/podman-in-kubernetes). These are possible in theory but tricky in practice, with the ways that the janitor is currently being run (e.g. in GKE).

[jelmer]

The main issue here seems to be the presence of device node files. Perhaps we can use fakeroot to work around this?

[jelmer]

In practice, it might look something like this:

• codemod as a docker image E.g., lintian-brush, debianize, Volumes: /code, /result.json, /result
• build step as a docker image, or maybe an external service (e.g. debusine?) Write to /result /result.json E.g. ognibuild/generic:sid, ognibuild/debian:sid
• analysis step /build E.g. lintian