On 10/29/2026 12:10 PM, Fabiano Rosas wrote: > Pierrick Bouvier <[email protected]> writes: > >> On 10/29/2026 11:35 AM, Fabiano Rosas wrote: >>> Pierrick Bouvier <[email protected]> writes: >>> >>>> On 10/29/2026 10:39 AM, Fabiano Rosas wrote: >>>>> Pierrick Bouvier <[email protected]> writes: >>>>> >>>>>> On 10/29/2026 6:41 AM, Fabiano Rosas wrote: >>>>>>> Pierrick Bouvier <[email protected]> writes: >>>>>>> >>>>>>>> This new dockerfile allows to build a distroless image containing only >>>>>>>> qemu stripped release binaries, their lib dependencies, and installed >>>>>>>> artifacts (roms, keymap, ...). There is no shell, no python, nothing >>>>>>>> else. This is achieved thanks to a multi-stage build, where we add qemu >>>>>>>> binaries, artifacts and libraries in a new scratch image. Image has >>>>>>>> the minimal size possible. >>>>>>>> >>>>>>>> This is based on Ubuntu, which has the advantage to have working >>>>>>>> containers available down to 14.04. Debian old old stable have broken >>>>>>>> apt sources for instance. >>>>>>>> >>>>>>>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018). >>>>>>>> We could build down to v0.12.0, but it would require more tweaks in the >>>>>>>> dockerfile, so we keep it simple instead. >>>>>>>> >>>>>>>> To build the image, you need to provide a qemu and ubuntu version: >>>>>>>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 >>>>>>>> --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0 >>>>>>>> >>>>>>>> To run it, as there is no shell, and no defined entrypoint, you need to >>>>>>>> choose the binary you want explicitely: >>>>>>>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version >>>>>>>> >>>>>>>> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> >>>>>>>> Reviewed-by: Fabiano Rosas <[email protected]> >>>>>>>> Signed-off-by: Pierrick Bouvier <[email protected]> >>>>>>>> --- >>>>>>>> tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++ >>>>>>>> 1 file changed, 48 insertions(+) >>>>>>>> create mode 100644 tests/docker/dockerfiles/release.docker >>>>>>>> >>>>>>>> diff --git a/tests/docker/dockerfiles/release.docker >>>>>>>> b/tests/docker/dockerfiles/release.docker >>>>>>>> new file mode 100644 >>>>>>>> index 00000000000..ca6babde01e >>>>>>>> --- /dev/null >>>>>>>> +++ b/tests/docker/dockerfiles/release.docker >>>>>>>> @@ -0,0 +1,48 @@ >>>>>>>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set" >>>>>>>> + >>>>>>>> +FROM ubuntu:$UBUNTU_VERSION AS build >>>>>>>> + >>>>>>>> +# add deb-src for apt build-dep >>>>>>>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i >>>>>>>> /etc/apt/sources.list.d/* || true >>>>>>>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list >>>>>>>> +# archive.canonical.com is not reachable anymore, and cause a long >>>>>>>> timeout >>>>>>>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list >>>>>>>> + >>>>>>>> +# build dependencies >>>>>>>> +RUN apt update && \ >>>>>>>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential >>>>>>>> flex bison >>>>>>>> +RUN apt update && \ >>>>>>>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu >>>>>>>> + >>>>>>>> +ARG QEMU_VERSION >>>>>>>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be >>>>>>>> set}" >>>>>>>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"; >>>>>>>> + >>>>>>>> +RUN cd /tmp && \ >>>>>>>> +mkdir qemu && cd qemu && git init && \ >>>>>>>> +git remote add origin "${QEMU_REPO}" && \ >>>>>>>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \ >>>>>>>> +git checkout FETCH_HEAD && \ >>>>>>>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \ >>>>>>>> +make install -j $(nproc) && \ >>>>>>>> +strip /opt/qemu/bin/* && \ >>>>>>> >>>>>>> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line >>>>>>> to make migration-test work from inside the container: >>>>>>> >>>>>>> migration-test >>>>>>> sh >>>>>>> env >>>>>>> docker (installed as docker.io up there) >>>>>>> cat >>>>>>> >>>>>> >>>>>> You mean by mounting current folder in the container? >>>>>> >>>>> >>>>> I mean having the test binary present in the container as well. >>>>> >>>>> This is something specific to migration compat testing: to avoid having >>>>> issues due to features mismatches, we run the older version of >>>>> migration-test when testing two different QEMU versions. >>>>> >>>>> But then... >>>>> $ git checkout <old tag> >>>>> $ make check-build >>>>> $ ./migration-test <QEMU old container> <QEMU new container> >>>>> >>>>> is kind of wasteful. I can simply build a container with QEMU + >>>>> migration-test already in it and invoke: >>>>> >>>>> $ ./<migration-test old container> <QEMU old container> <QEMU new >>>>> container> >>>>> >>>> >>>> Ok, I see. I'm not very familiar with migration testing, and assumed the >>>> logic was opposite (that migration-test is backward compatible to test >>>> from old versions). >>>> >>> >>> It was the original idea, but we noticed it was way easier to just pin >>> the test. >>> >> >> I guess there are good reasons for it, but it seems like it would be >> much better to work from current HEAD instead of having to checkout and >> build an older version of the test. > > There are advantages to using the old tests, maybe the main one is that > we never need to think about older versions when writing the tests. > What was there at the time is what's supported and that's it. If an old > test breaks with a new QEMU, then the users will probably see the exact > same breakage. > >> Flagging sub test per QEMU version does not seem too complex to >> implement (min_version=8.0.x, so this test is skipped when running with >> an older QEMU). >> > > These are big integration tests that all run the entire migration > process from end to end. If they were smaller unit tests, then it would > be indeed simpler. But I confess we didn't try too hard. > >>>> But migration-test is not included in old container, since it's a test >>>> binary (thus not installed). I feel that for this case, you need to >>>> build from sources, at least to get migration-test-old. >>>> >>> >>> It's built inside the container along with QEMU. The cp line I added >>> brings it over. >>> >> >> Got you. >> >>>>>> I'm not against it, but I feel that if we go this way, it's just easier >>>>>> to say "let's use the full base image", since it will become "I need to >>>>>> run python, and X, and Y, and Z". >>>>>> >>>>> >>>>> I think we should merge this series as is. However if we intend to use >>>>> it in the future for something more complex, something like the above >>>>> will probably come up. Anyway, I posted literally "for the record". >>>>> >>>> >>>> Sure, I'm just interested to make something useful for you. If it's half >>>> baked, there is little value in merging this. >>>> >>> >>> I don't want to enlarge this container too much. In its current form >>> it's also useful to others. >>> >> >> Yes, I'll merge it as it is for now. >> > > Yep, thanks again! >
Feel free to send a patch in the future to add deps and extra binaries with an associated --build-arg INCLUDE_TEST_BINARIES. As long as it's not the default behavior, there is no problem to include it. Regards, Pierrick
