Refactor development container workflow e.g. based on Podman

[lueschem]

Wish-list

• Individual users shall be able to pull "digital twin" development containers from a registry instead of building them on their own.
• Customization of the development containers shall happen "on the fly" e.g. using distrobox.
• Build agents shall be able to pull build containers from a central registry.
• Containers shall be shared using the OCI format.
• Docker and Podman users shall be able to consume the OCI container images.
• If possible, container builds shall happen in rootless mode (e.g. using unshare/fakeroot when creating the initial container).

Prototyping

• buildah looks like a great tool to build OCI images
• podman can run containers with and without invoking systemd
• there is a buildah plugin for ansible
• the resulting containers can be used together with distrobox
• building the containers in rootless mode might have a performance impact
• rootless prototype so far: mmdebstrap --> .tar --> fakeroot expand to unshared buildah mount (to be checked: nobody/nogroup ownership of /dev/null)

[lueschem]

Rootless container build:

#!/bin/bash

set -o nounset
set -o errexit
set -o pipefail

newcontainer=$(buildah from scratch)
buildah unshare --mount container_root=${newcontainer} bash -c 'mmdebstrap --mode=unshare --include=python3,python3-apt,sudo,netbase,net-tools,iputils-ping,isc-dhcp-client,systemd,systemd-sysv,gnupg,dumb-init --variant=minbase bookworm ${container_root}'

echo ${newcontainer}

Run the container with distrobox:

buildah commit CONTAINER_NAME
distrobox create --image IMAGE_ID --name SOME_CONTAINER_NAME --unshare-all --init