P2P Packaging/Koji Cloud

[Josh Boyer]

On Wed, Dec 7, 2011 at 8:46 AM, Denis Arnaud
<denis.arnaud_fedora at m4x.org> wrote:
> Hello,
>
> RedHat-hosted Koji servers offer an invaluable service by allowing all of
> us, package maintainers, to build all of "our" Fedora packages. I guess that
> that infrastructure is not cost-less for RedHat and and the quality of
> service is great (for instance, the wait in the queues, before Koji actually
> builds the packages submitted via the command-line client, is not so long).
>
> As Fedora is pretty advanced in the cloud/virtualisation arena, we could
> imagine a "Koji Cloud", hosted on VMs offered by volunteers. For instance, I
> could contribute a few VMs in Europe (hosted on http://www.ovh.co.uk/). Our
> Cloud SIG (https://fedoraproject.org/wiki/Cloud_SIG) and/or Virt ML
> (https://admin.fedoraproject.org/mailman/listinfo/virt and https://fedoraproject.org/wiki/Getting_started_with_virtualization)/RedHat
> ET (http://et.redhat.com/) colleagues could help designing and implementing
> the following infrastructure:

I believe Seth Vidal looked at auto-starting koji builder instances in
the cloud a while ago.  Hopefully he'll chime in.

The one thing you don't address is security.  If we're going to push
stuff to a public cloud, how do you ensure that the builder VMs aren't
compromised?

josh