fakesystemd package breaking builds

[Lennart Poettering]

On Wed, 27.08.14 21:00, Václav Pavlín (vpavlin at redhat.com) wrote:

> >I also offered to split out the hwdb in Brno, if you remember. If this
> >is about the hwdb, then let's just do that...
>
> Talk to Michal Sekletar about it then - he is working on "something"
> we call systemd-container internally. We need systemd running in
> Docker container. I don't like to have needless stuff in images but
> if the result is "just drop the hwdb" then I am fine with that.

As discussed in Brno, "not liking to have needless stuff around" alone
is really not a convincing reason. 

I mean, you could make the case for the size of things, but afaics this
doesn't hold any water here... kmod is a 150K dep, and the other stuff,
is that any bigger? For 150K we shouldn't complicate things this much...

You could also make the case for the dependencies, but this is kind the
same as the size argument...

And you could make the case for "security", but that's really wrong too,
since recent systemd versions have exactly zero suid binaries, and if
you don't run the daemons, then you have exactly zero ways to raise your
priviliges. And just having dead code lying around is not really an
issue. I mean, if you managed to exploit something and smuggled in some
code, then you smuggled in some code, why would make it any difference
if there's dead code lying around or not in the container?

> >But regarding kmod/devicemapper, can we please get some stats about how
> >big this individually are, and how much is saved by this? kmod at least
> >is 150K or so only. Is there really any value in doing this weird stuff
> >for a fricking 150K?! Fedora has no bigger fishes to fry?
> I'll prepare stats for you tomorrow.
> >
> >The systemd-container or fakesystemd stuff sounds awfully adhoc. Can we
> >please always discuss this first, and see if we can find a different
> >solution? We don't need three different "solutions", if one works
> >too...
>
> We've talked about this on Flock - it's not only about disk space
> but also about security reasons (CC'ing Dan Walsh). My goal was not

Dan, can you elaborate what the rationale for this is?

> to have needless junk in base image - if we are not going to use
> systemd to manage services there, why should it be there with all
> it's dependencies?

This sounds awfully like a "just because!" reason... 

Lennart

-- 
Lennart Poettering, Red Hat