Pierrick Bouvier <[email protected]> writes: > On 10/29/2026 10:39 AM, Fabiano Rosas wrote: >> Pierrick Bouvier <[email protected]> writes: >> >>> On 10/29/2026 6:41 AM, Fabiano Rosas wrote: >>>> Pierrick Bouvier <[email protected]> writes: >>>> >>>>> This new dockerfile allows to build a distroless image containing only >>>>> qemu stripped release binaries, their lib dependencies, and installed >>>>> artifacts (roms, keymap, ...). There is no shell, no python, nothing >>>>> else. This is achieved thanks to a multi-stage build, where we add qemu >>>>> binaries, artifacts and libraries in a new scratch image. Image has >>>>> the minimal size possible. >>>>> >>>>> This is based on Ubuntu, which has the advantage to have working >>>>> containers available down to 14.04. Debian old old stable have broken >>>>> apt sources for instance. >>>>> >>>>> This unique dockerfile works for all qemu versions >= 3.1.0 (2018). >>>>> We could build down to v0.12.0, but it would require more tweaks in the >>>>> dockerfile, so we keep it simple instead. >>>>> >>>>> To build the image, you need to provide a qemu and ubuntu version: >>>>> $ podman build -f release.Dockerfile --build-arg QEMU_VERSION=v11.1.0 >>>>> --build-arg UBUNTU_VERSION=24.04 -t qemu/v11.1.0 >>>>> >>>>> To run it, as there is no shell, and no defined entrypoint, you need to >>>>> choose the binary you want explicitely: >>>>> $ podman run -it --rm qemu/v11.1.0 qemu-system-aarch64 --version >>>>> >>>>> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> >>>>> Reviewed-by: Fabiano Rosas <[email protected]> >>>>> Signed-off-by: Pierrick Bouvier <[email protected]> >>>>> --- >>>>> tests/docker/dockerfiles/release.docker | 48 +++++++++++++++++++++++++ >>>>> 1 file changed, 48 insertions(+) >>>>> create mode 100644 tests/docker/dockerfiles/release.docker >>>>> >>>>> diff --git a/tests/docker/dockerfiles/release.docker >>>>> b/tests/docker/dockerfiles/release.docker >>>>> new file mode 100644 >>>>> index 00000000000..ca6babde01e >>>>> --- /dev/null >>>>> +++ b/tests/docker/dockerfiles/release.docker >>>>> @@ -0,0 +1,48 @@ >>>>> +ARG UBUNTU_VERSION="UBUNTU_VERSION_build_arg_must_be_set" >>>>> + >>>>> +FROM ubuntu:$UBUNTU_VERSION AS build >>>>> + >>>>> +# add deb-src for apt build-dep >>>>> +RUN sed -e 's/Types: deb/Types: deb deb-src/' -i >>>>> /etc/apt/sources.list.d/* || true >>>>> +RUN sed -e 's/# deb-src/deb-src/' -i /etc/apt/sources.list >>>>> +# archive.canonical.com is not reachable anymore, and cause a long >>>>> timeout >>>>> +RUN sed -e '/archive.canonical.com/d' -i /etc/apt/sources.list >>>>> + >>>>> +# build dependencies >>>>> +RUN apt update && \ >>>>> +env DEBIAN_FRONTEND=noninteractive apt install -y git build-essential >>>>> flex bison >>>>> +RUN apt update && \ >>>>> +env DEBIAN_FRONTEND=noninteractive apt build-dep -y --arch-only qemu >>>>> + >>>>> +ARG QEMU_VERSION >>>>> +RUN echo "QEMU_VERSION=${QEMU_VERSION:?QEMU_VERSION build arg must be >>>>> set}" >>>>> +ARG QEMU_REPO="https://gitlab.com/qemu-project/qemu.git"; >>>>> + >>>>> +RUN cd /tmp && \ >>>>> +mkdir qemu && cd qemu && git init && \ >>>>> +git remote add origin "${QEMU_REPO}" && \ >>>>> +git fetch origin "${QEMU_VERSION}" --depth 1 && \ >>>>> +git checkout FETCH_HEAD && \ >>>>> +./configure --prefix=/opt/qemu --disable-docs --disable-werror && \ >>>>> +make install -j $(nproc) && \ >>>>> +strip /opt/qemu/bin/* && \ >>>> >>>> For the record, here I included a 'cp <list of bins> /opt/qemu/bin' line >>>> to make migration-test work from inside the container: >>>> >>>> migration-test >>>> sh >>>> env >>>> docker (installed as docker.io up there) >>>> cat >>>> >>> >>> You mean by mounting current folder in the container? >>> >> >> I mean having the test binary present in the container as well. >> >> This is something specific to migration compat testing: to avoid having >> issues due to features mismatches, we run the older version of >> migration-test when testing two different QEMU versions. >> >> But then... >> $ git checkout <old tag> >> $ make check-build >> $ ./migration-test <QEMU old container> <QEMU new container> >> >> is kind of wasteful. I can simply build a container with QEMU + >> migration-test already in it and invoke: >> >> $ ./<migration-test old container> <QEMU old container> <QEMU new container> >> > > Ok, I see. I'm not very familiar with migration testing, and assumed the > logic was opposite (that migration-test is backward compatible to test > from old versions). >
It was the original idea, but we noticed it was way easier to just pin the test. > But migration-test is not included in old container, since it's a test > binary (thus not installed). I feel that for this case, you need to > build from sources, at least to get migration-test-old. > It's built inside the container along with QEMU. The cp line I added brings it over. >>> I'm not against it, but I feel that if we go this way, it's just easier >>> to say "let's use the full base image", since it will become "I need to >>> run python, and X, and Y, and Z". >>> >> >> I think we should merge this series as is. However if we intend to use >> it in the future for something more complex, something like the above >> will probably come up. Anyway, I posted literally "for the record". >> > > Sure, I'm just interested to make something useful for you. If it's half > baked, there is little value in merging this. > I don't want to enlarge this container too much. In its current form it's also useful to others. For migration, we'd need the extra binaries I mentioned plus the output of -dump-vmstate to run ./scripts/vmstate-static-checker.py. It's probably better to have a separate container image with those. > Regards, > Pierrick
