Pierrick Bouvier <[email protected]> writes: > On 10/29/2026 6:41 AM, Fabiano Rosas wrote: >> Pierrick Bouvier <[email protected]> writes: >> >>> This new dockerfile allows to build a distroless image containing only >>> qemu stripped release binaries, their lib dependencies, and installed >>> artifacts (roms, keymap, ...). There is no shell, no python, nothing >>> else. This is achieved thanks to a multi-stage build, where we add qemu >>> binaries, artifacts and libraries in a new scratch image. Image has >>> the minimal size possible. >>> >>> This is based on Ubuntu, which has the advantage to have working >>> containers available down to 14.04. Debian old old stable have broken >>> apt sources for instance. >>> >>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018). >>> We could build down to v0.12.0, but it would require more tweaks in the >>> dockerfile, so we keep it simple instead. >>> >>> To build the image, you need to provide a qemu and ubuntu version: >>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 >>> --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0 >>> >>> To run it, as there is no shell, and no defined entrypoint, you need to >>> choose the binary you want explicitely: >>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version >>> >>> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> >>> Reviewed-by: Fabiano Rosas <[email protected]> >>> Signed-off-by: Pierrick Bouvier <[email protected]> >>> --- >>> tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++ >>> 1 file changed, 48 insertions(+) >>> create mode 100644 tests/docker/dockerfiles/release.docker >>> >>> diff --git a/tests/docker/dockerfiles/release.docker >>> b/tests/docker/dockerfiles/release.docker >>> new file mode 100644 >>> index 00000000000..ca6babde01e >>> --- /dev/null >>> +++ b/tests/docker/dockerfiles/release.docker >>> @@ -0,0 +1,48 @@ >>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set" >>> + >>> +FROM ubuntu:$UBUNTU_VERSION AS build >>> + >>> +# add deb-src for apt build-dep >>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i /etc/apt/sources.list.d/* >>> || true >>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list >>> +# archive.canonical.com is not reachable anymore, and cause a long timeout >>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list >>> + >>> +# build dependencies >>> +RUN apt update && \ >>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential flex >>> bison >>> +RUN apt update && \ >>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu >>> + >>> +ARG QEMU_VERSION >>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be set}" >>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"; >>> + >>> +RUN cd /tmp && \ >>> +mkdir qemu && cd qemu && git init && \ >>> +git remote add origin "${QEMU_REPO}" && \ >>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \ >>> +git checkout FETCH_HEAD && \ >>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \ >>> +make install -j $(nproc) && \ >>> +strip /opt/qemu/bin/* && \ >> >> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line >> to make migration-test work from inside the container: >> >> migration-test >> sh >> env >> docker (installed as docker.io up there) >> cat >> > > You mean by mounting current folder in the container? >
I mean having the test binary present in the container as well. This is something specific to migration compat testing: to avoid having issues due to features mismatches, we run the older version of migration-test when testing two different QEMU versions. But then... $ git checkout <old tag> $ make check-build $ ./migration-test <QEMU old container> <QEMU new container> is kind of wasteful. I can simply build a container with QEMU + migration-test already in it and invoke: $ ./<migration-test old container> <QEMU old container> <QEMU new container> > I'm not against it, but I feel that if we go this way, it's just easier > to say "let's use the full base image", since it will become "I need to > run python, and X, and Y, and Z". > I think we should merge this series as is. However if we intend to use it in the future for something more complex, something like the above will probably come up. Anyway, I posted literally "for the record". > What is missing to just use the container as a binary, instead of having > to mount anything inside it? > >>> +rm -rf /tmp/* >>> + >>> +# retrieve runtime dependencies (libs) >>> +RUN ldd /opt/qemu/bin/* | grep '=>' | sed -e 's/.*=>//' -e 's/(.*//' | >>> sort -u > /opt/qemu/libs >>> +# store them in /deps/lib >>> +RUN mkdir -p /deps/lib && cp --preserve --dereference $(cat >>> /opt/qemu/libs) /deps/lib >>> +# copy loader (with its original path) >>> +RUN cp --preserve --parents --dereference /lib*/ld-linux* /deps/ >>> + >>> +################################################################################ >>> +FROM scratch >>> + >>> +COPY --from=build /deps / >>> +# copy qemu and all associated artifacts (roms, ...) >>> +COPY --from=build /opt/qemu /usr >>> + >>> +# build with: >>> +# podman build -f release.docker --build-arg QEMU_VERSION=v11.1.0 >>> --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0 >>> +# run with: >>> +# podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version
