Skip to content

Conversation

Kern--
Copy link
Contributor

@Kern-- Kern-- commented Jul 31, 2025

Issue #, if available:

Description of changes:

FCCD's `make clean` used to call `make clean-in-docker` for the image
builder. The image builder builds a docker image if necessary, then
mounts all the directories and calls clean. This is because some of the
resources were built in docker which may be owned by root.

On the buildkite runners, make clean is run as root because some of the
subdirectores need root permission to clean appropriately. This was causing
docker to build an image and to create a buildkit lock as root which caused
subsequent steps in the pipeline to fail if they tried to build a container
as non-root.

The solution here is to call the image builder's regular clean target
which will directly delete resources if it is root, otherwise it will
call clean-in-docker. Thist way, the clean will not need to create a
container to do the cleanup and will not create a lock as root.

An alternative would be to go through all the subdirectories' clean
targets to make sure they have an equivalent clean-in-docker that is
only run if the clean target is run as root. This would be a good follow
up once tests are passing again.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@Kern-- Kern-- requested a review from a team as a code owner July 31, 2025 22:23
@Kern-- Kern-- changed the title Run buildkite clean as non-root Don't force image builder to clean-in-docker Aug 1, 2025
sondavidb
sondavidb previously approved these changes Aug 1, 2025
FCCD's `make clean` used to call `make clean-in-docker` for the image
builder. The image builder builds a docker image if necessary, then
mounts all the directories and calls clean. This is because some of the
resources were built in docker which may be owned by root.

On the buildkite runners, make clean is run as root because some of the
subdirectores need root permission to clean appropriately. This was causing
docker to build an image and to create a buildkit lock as root which caused
subsequent steps in the pipeline to fail if they tried to build a container
as non-root.

The solution here is to call the image builder's regular clean target
which will directly delete resources if it is root, otherwise it will
call clean-in-docker. Thist way, the clean will not need to create a
container to do the cleanup and will not create a lock as root.

An alternative would be to go through all the subdirectories' clean
targets to make sure they have an equivalent clean-in-docker that is
only run if the clean target is run as root. This would be a good follow
up once tests are passing again.

Signed-off-by: Kern Walster <[email protected]>
@Kern-- Kern-- merged commit f05e3ff into firecracker-microvm:main Aug 4, 2025
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants