Support rootless Docker to build firmware

[DBLouis]

The problem you're addressing (if any)

It would be nice to be able to build the firmware with a rootless Docker install.

Describe the solution you'd like

Maybe having a second Docker image and a optional parameter to the build.sh script is good enough.

Where is the value to a user, and who might that user be?

No response

Describe alternatives you've considered

In the meantime, I was able to make it work by simply rebuilding the coreboot-sdk image like this:

FROM coreboot/coreboot-sdk:version
USER root

And modifying build.sh accordingly, replacing the image name and removing -u $UID for each docker command.

Additional context

No response

[iciclejj]

It would be nice to be able to build the firmware with a rootless Docker install.

Is the issue simply about being able to build dasharo with a rootless docker install/daemon, or was the thought to have a fully rootless docker container, including the user inside the container?

If root user within the container is fine, then simply setting UID=root ./build.sh ... looks to be enough for me to bulid everything already. Only the ec firmware build script needs to be modified to also read a UID env var, like the coreboot build script already does.

[DBLouis]

Yes my issue was simply about being about to build dasharo with a rootless docker daemon.

[Clubhouse1661]

Hi, I'd like to work on this issue.

My plan:

• Study how the coreboot build.sh handles UID
• Implement similar support in the EC build script
• Test with rootless Docker setup

Please let me know if I can be assigned to this issue.

[philipanda]

Hi again @Clubhouse1661, thanks for your interest in solving the issue.

It's great that you've shared a plan for approaching it.
While the simple workarounds suggested by the author of the issue and in the comments might work for a single case it's a good idea to study the deps to reduce unforeseen consequences.

I'd just like to mention that we'll probably need more than one test run of the build system and a way to verify it still works as expected. If the hashes of the release binaries match, then that would suffice.
We will decide which platforms we'd like to be built and verified to work once the task progresses, unless you'd like to suggest a test scope yourself later.

[philipanda]

What's the progress @Clubhouse1661? Have you encountered any difficulties?

[philipanda]

@Clubhouse1661 I'll unassign you from this issue due to no activity to give others a chance. If you're still interested in getting this bounty, just say it and we'll reassign you.

[Suraj-kumar00]

Hi @philipanda, I would love to work on this. Seems interesting to me. Could you please assign this issue to me so that i can start working.

Also want to know if this is still an active project as I can't see any activity on this specific project from last 3 months.

Also would love to know the bounty amount as this is labeled as bouty ticket.

Thanks,
Suraj

[philipanda]

Hi @Suraj-kumar00,

Also want to know if this is still an active project as I can't see any activity on this specific project from last 3 months.

This repository is only used for keeping track of all the issues related to Dasharo as a whole. It's not be easy for someone to pinpoint which module is causing problems and make an issue for the correct repository without knowledge and investigation.

Also would love to know the bounty amount as this is labeled as bouty ticket.

You can get the estimates at https://3mdeb.com/bug-bounty/. I think @macpijan might tell you more.

[Suraj-kumar00]

Hi @philipanda, thanks for assigning the issue to me. I'm starting working on this and will raise the draft PR soon.

Thanks.