Static Build with nix Package Manager

[hswong3i]

Currently adhoc compile crun master from source code are blocked for following legacy OS:

• Ubuntu 16.04
  • systemd v229 is too old for sd_bus_match_signal_async (require systemd >= v237, see make error "undefined reference to `sd_bus_match_signal_async'" on Ubuntu #349)
• CentOS 7
  • systemd v219 is too old for everything...
  • systemd v231 from https://copr.fedorainfracloud.org/coprs/jsynacek/systemd-backports-for-centos-7/ is still too old for sd_bus_match_signal_async (see [CentOS 7] Missing libsystemd headers #359)
• openSUSE 15.1/15.2
  • systemd v234 is again too old for sd_bus_match_signal_async (see [openSUSE 15.1] Missing libseccomp headers #360)
  • libseccomp is not in standard location (see [openSUSE 15.1] Missing libseccomp headers #360)

Ideally this could be handled by using static build (see https://github.com/containers/crun/blob/master/contrib/static-builder-x86_64/README.md); BTW the logic of this method is also a bit chicken or the egg like:

• In order to run the build we "need first to create the container image"
• The container image should be created by podman
• podman need a container runtime, e.g. runc or crun
• As long as crun is not yet ready, we need to install runc + podman for "create the container image for build" (!?)
• Once build completed, we uninstall runc (!!) and replace it with the newly crun static build (!?)

Besides download the provided static build archive from crun release page (https://github.com/containers/crun/releases), another workaround could be using "nix Package Manager" (https://nixos.org/nix/) for static build locally, e.g.

• CRI-O (https://github.com/cri-o/cri-o/blob/master/tutorials/setup.md#static-builds)
• Podman (https://github.com/containers/libpod/blob/master/README.md#static-binary-builds)

Shall we also go for a similar solution?

[hswong3i]

@saschagrunert could have more idea for nix?

[hswong3i]

Oh does it already available in nix (see https://nixos.org/nixos/packages.html?attr=crun&channel=nixpkgs-unstable&query=crun)?

[saschagrunert]

Hm, I see your points @hswong3i and I think it would be possible to build it via nix statically.

I guess improving the already existing static build toolchain might be a more valuable approach rather then removing it completely. I'm not sure what @giuseppe thinks about this.

[giuseppe]

I think the *nix approach is cleaner, just I am not familiar with it. @saschagrunert if you'd like we can move/maintain the *nix build scripts in the main repository and replace the existing build script

[hswong3i]

Ideally if both crun/conmon/skopeo/buildah/podman/crio could provide static build based on nix, I could therefore simplify my Ansible Roles as simple as that for etcd/kubectl/kubeadm/kubelet (e.g. https://github.com/alvistack/ansible-role-etcd/blob/master/tasks/main.yml#L86-L102), which directly download the portable binary archive and go.

Before that all portable binary could be happened, I am going to keep my Ansible Roles for crun/conmon/skopeo/buildah/podman/crio in "compile from source code on each supported OS" style (e.g. https://github.com/alvistack/ansible-role-cri_o/blob/master/tasks/main.yml#L109-L134) for easy debug with latest release.

BTW, if systemd in crun couldn't be friendly enough for CentOS 7 and openSUSE 15.1 (which some of my customers are using that daily in their business), I will surely vote for "compile from source with nix" solution ;-)

[saschagrunert]

I'm now working on the issue but got a question regarding systemd. I'll ask on the PR.