(Not tested)

See also https://pagure.io/releng/issue/6602#comment-72340

Hm, we may need a way to inject into the config, not the command line. Will look.

Reworked to just do nspawn_args, and write to the mock config. Still not tested but seems likely to work!

Blocks: https://pagure.io/pungi/pull-request/560

Please, alter also tests/test_cli/test_runroot.py (just adding new option in the last call).

You are passing a new option to genMockConfig, but genMockConfig does not know to do anything with it.

Also, I am little wary of directly exposing this. I don't think runroot users should need to specify arbitrary nspawn args.

Do you have an alternative suggestion? The pungi rpm-ostree task should be moved into koji, and the nspawn arguments as well?

Do we expect much variation in these args? The minimal allowance would be a flag that adds these specific options rather than passing through arbitrary options.

Seems like --as-pid2 ought to be the default in this situation anyway. How often is mock going to run something in the chroot that is really prepared to act like init?

Yes; https://github.com/rpm-software-management/mock/pull/36

As far as the networking one - so rpm-ostree needs access to the network to fetch RPMs, but uses it to explicitly turn off networking for scripts. It's somewhat optional, but it's a stronger and more reliable mechanism than what people do today with Koji using firewalling rules.

So...we could make it optional, it wouldn't be hard but not entirely trivial either.

So...maybe we could just unconditionally turn on --capability CAP_NET_ADMIN for runroot?

(What things are using runroot other than rpm-ostree?)

commenting so that I can get notifications

@walters Other than the ostree, pungi is also using runroot to create isos (running genisoimage, isohybrid, implantmd5 etc.; this only uses filesystem access, no network needed). Lorax is run in runroot as well. I think it should not be doing network access either, the compose directory is mounted in the chroot. Lastly ostree installer is done in runroot, but that's just a sligtly different run of lorax.

Actually nevermind, since pungi runs rpm-ostree as a subprocess, we don't need the --as-pid2 (though it's still a good idea in the future, since pungi-make-ostree is not designed to be pid 1).

I'm going to change rpm-ostree to detect and work around the lack of CAP_NET_ADMIN.

Actually nevermind, since pungi runs rpm-ostree as a subprocess, we don't need the --as-pid2 (though it's still a good idea in the future, since pungi-make-ostree is not designed to be pid 1).

I will point out that mock now sets --as-pid2 by default for systemd-nspawn.

https://github.com/projectatomic/rpm-ostree/pull/672