osbuilder: Evaluate replacing osbuilder with mkosi

kata-containers / kata-containers

Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. https://katacontainers.io/

Apache License 2.0

5.26k stars 1.03k forks source link

osbuilder: Evaluate replacing osbuilder with mkosi #8779

Open fidencio opened 7 months ago

fidencio commented 7 months ago

mkosi is a tool that can be used to generate customised disk images "with a number of bells and whistles".

This is basically what osbuilder does, with the difference that we don't have to maintain it. :-)

mkosi: https://github.com/systemd/mkosi

From an initial look at the project, I've noticed that there are a few gaps that we may need to close before switching to mkosi, being:

Support to Alpine: https://github.com/systemd/mkosi/issues/677
Support to build an imagine from inside a container: https://github.com/systemd/mkosi/issues/248

It'd be nice if someone finds the time to play with mkosi and propose the switch.

I'm aware that Paul (from Edgeless) and Mikko (from Intel) have already been playing with mkosi, so I'd like to hear their input here.

stevenhorsman commented 7 months ago

It's worth noting that mkosi doesn't support s390x at the moment (I',m not sure about power, or arm - I couldn't quickly spot anything after a google). @huoqifeng has rasied https://github.com/confidential-containers/cloud-api-adaptor/issues/1640 to discuss closing this gap.

katexochen commented 7 months ago

arm is supported by mkosi, I have built arm images before with it. Cross-building isn't that well tested but possible. https://github.com/systemd/mkosi/blob/main/mkosi/resources/mkosi.md#distribution-section

katexochen commented 7 months ago

One big advantage of mkosi is that, when used with the right setup, it enables to build bit-by-bit reproducible OS images. This is especially interesting for the Confidential Computing use case of Kata.

On the other hand, mkosi is quite close to systemd, and building non-systemd images will be quite a challenge, in the same way as building non-UEFI images (s390x).

mkulke commented 7 months ago

enumerating alternatives: buildroot as a possibly boring option?

malt3 commented 7 months ago

Yocto is another alternative that is similar to buildroot.