Merge pull request #537 from advancedtelematic/ci/oe-selftest

Ci/oe selftest

21 files changed, 419 insertions, 124 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..3682753
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,98 @@
+stages:
+  - docker
+  - checkout
+  - test
+
+variables:
+  BITBAKE_IMAGE: ${CI_REGISTRY_IMAGE}:ci-${CI_COMMIT_REF_SLUG}-bitbake
+  BITBAKE_CHECKOUT_IMAGE: ${CI_REGISTRY_IMAGE}:ci-${CI_COMMIT_REF_SLUG}-checkout
+
+include:
+  - local: "scripts/ci/gitlab/docker.yml"
+  - local: "scripts/ci/gitlab/checkout.yml"
+  - local: "scripts/ci/gitlab/tests.yml"
+
+Docker setup:
+  extends: .bb_docker_local
+
+  stage: docker
+  variables:
+    BITBKAE_IMAGE_MASTER: ${CI_REGISTRY_IMAGE}:ci-master-bitbake
+    BITBAKE_CHECKOUT_IMAGE_MASTER: ${CI_REGISTRY_IMAGE}:ci-master-checkout
+  except:
+    - pushes
+
+Checkout:
+  extends: .bb_checkout
+
+  stage: checkout
+  variables:
+    MANIFEST: master
+    CURRENT_PROJECT: meta-updater
+  except:
+    - pushes
+
+Build core-image-minimal:
+  extends: .bitbake
+
+  stage: test
+  variables:
+    TEST_BUILD_DIR: 'build-core-image-minimal'
+    BITBAKE_TARGETS: 'core-image-minimal'
+  artifacts:
+    name: "core-image-minimal_$CI_COMMIT_REF_SLUG"
+    paths:
+      - $TEST_BUILD_DIR/tmp/deploy/images/*/core-image-minimal*
+  except:
+    - pushes
+
+Oe-selftest qemux86_64:
+  extends: .oe-selftest
+
+  stage: test
+  variables:
+    TEST_BUILD_DIR: 'build-oe-qemux86_64'
+    OE_SELFTESTS: 'updater_native updater_qemux86_64'
+  except:
+    - pushes
+
+# Not run by default, triggered on nightlies
+
+Oe-selftest minnowboard:
+  extends: .oe-selftest
+
+  stage: test
+  variables:
+    TEST_BUILD_DIR: 'build-oe-minnowboard'
+    OE_SELFTESTS: 'updater_minnowboard'
+  except:
+    - pushes
+  only:
+    variables:
+      - $OE_MINNOWBOARD
+
+Oe-selftest rpi:
+  extends: .oe-selftest
+
+  stage: test
+  variables:
+    TEST_BUILD_DIR: 'build-oe-rpi'
+    OE_SELFTESTS: 'updater_rpi'
+  except:
+    - pushes
+  only:
+    variables:
+      - $OE_RPI
+
+Ptest qemux86_64:
+  extends: .oe-selftest
+
+  stage: test
+  variables:
+    TEST_BUILD_DIR: 'build-oe-qemux86_64-ptest'
+    OE_SELFTESTS: 'updater_qemux86_64_ptest'
+  except:
+    - pushes
+  only:
+    variables:
+      - $OE_PTEST
diff --git a/lib/oeqa/selftest/cases/testutils.py b/lib/oeqa/selftest/cases/testutils.py
index f8b1904..8d618a6 100644
--- a/lib/oeqa/selftest/cases/testutils.py
+++ b/lib/oeqa/selftest/cases/testutils.py
@@ -1,4 +1,5 @@
 import os
+import oe.path
 import logging
 import re
 import subprocess
@@ -33,6 +34,7 @@ def qemu_boot_image(imagename, **kwargs):
     args.dir = 'tmp/deploy/images'
     args.efi = kwargs.get('efi', False)
     args.machine = kwargs.get('machine', None)
+    args.mem = kwargs.get('mem', '128M')
     qemu_use_kvm = get_bb_var("QEMU_USE_KVM")
     if qemu_use_kvm and \
             (qemu_use_kvm == 'True' and 'x86' in args.machine or
@@ -60,7 +62,7 @@ def qemu_bake_image(imagename):
     bitbake(imagename)
 
 
-def qemu_send_command(port, command, timeout=60):
+def qemu_send_command(port, command, timeout=120):
     command = ['ssh -q -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no root@localhost -p ' +
                str(port) + ' "' + command + '"']
     s2 = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
@@ -68,24 +70,30 @@ def qemu_send_command(port, command, timeout=60):
     return stdout, stderr, s2.returncode
 
 
+def metadir():
+    # Assume the directory layout for finding other layers. We could also
+    # make assumptions by using 'show-layers', but either way, if the
+    # layers we need aren't where we expect them, we are out of luck.
+    path = os.path.abspath(os.path.dirname(__file__))
+    metadir = path + "/../../../../../"
+
+    return metadir
+
+
 def akt_native_run(testInst, cmd, **kwargs):
     # run a command supplied by aktualizr-native and checks that:
     # - the executable exists
     # - the command runs without error
-    # NOTE: the base test class must have built aktualizr-native (in
-    # setUpClass, for example)
-    bb_vars = get_bb_vars(['SYSROOT_DESTDIR', 'base_prefix', 'libdir', 'bindir'],
-                          'aktualizr-native')
-    sysroot = bb_vars['SYSROOT_DESTDIR'] + bb_vars['base_prefix']
-    sysrootbin = bb_vars['SYSROOT_DESTDIR'] + bb_vars['bindir']
-    libdir = bb_vars['libdir']
-
-    program, *_ = cmd.split(' ')
-    p = '{}/{}'.format(sysrootbin, program)
-    testInst.assertTrue(os.path.isfile(p), msg="No {} found ({})".format(program, p))
-    env = dict(os.environ)
-    env['LD_LIBRARY_PATH'] = libdir
-    result = runCmd(cmd, env=env, native_sysroot=sysroot, ignore_status=True, **kwargs)
+    #
+    # Requirements in base test class (setUpClass for example):
+    #   bitbake aktualizr-native
+    #   bitbake build-sysroots -c build_native_sysroot
+    #
+    # (technique found in poky/meta/lib/oeqa/selftest/cases/package.py)
+    bb_vars = get_bb_vars(['STAGING_DIR', 'BUILD_ARCH'])
+    sysroot = oe.path.join(bb_vars['STAGING_DIR'], bb_vars['BUILD_ARCH'])
+
+    result = runCmd(cmd, native_sysroot=sysroot, ignore_status=True, **kwargs)
     testInst.assertEqual(result.status, 0, "Status not equal to 0. output: %s" % result.output)
 
 
diff --git a/lib/oeqa/selftest/cases/updater_minnowboard.py b/lib/oeqa/selftest/cases/updater_minnowboard.py
index 267445b..855bd20 100644
--- a/lib/oeqa/selftest/cases/updater_minnowboard.py
+++ b/lib/oeqa/selftest/cases/updater_minnowboard.py
@@ -1,9 +1,8 @@
-import os
 import re
 
 from oeqa.selftest.case import OESelftestTestCase
 from oeqa.utils.commands import runCmd, get_bb_var
-from testutils import qemu_launch, qemu_send_command, qemu_terminate, verifyProvisioned
+from testutils import metadir, qemu_launch, qemu_send_command, qemu_terminate, verifyProvisioned
 
 
 class MinnowTests(OESelftestTestCase):
@@ -12,18 +11,13 @@ class MinnowTests(OESelftestTestCase):
         layer_intel = "meta-intel"
         layer_minnow = "meta-updater-minnowboard"
         result = runCmd('bitbake-layers show-layers')
-        # Assume the directory layout for finding other layers. We could also
-        # make assumptions by using 'show-layers', but either way, if the
-        # layers we need aren't where we expect them, we are out of luck.
-        path = os.path.abspath(os.path.dirname(__file__))
-        metadir = path + "/../../../../../"
         if re.search(layer_intel, result.output) is None:
-            self.meta_intel = metadir + layer_intel
+            self.meta_intel = metadir() + layer_intel
             runCmd('bitbake-layers add-layer "%s"' % self.meta_intel)
         else:
             self.meta_intel = None
         if re.search(layer_minnow, result.output) is None:
-            self.meta_minnow = metadir + layer_minnow
+            self.meta_minnow = metadir() + layer_minnow
             runCmd('bitbake-layers add-layer "%s"' % self.meta_minnow)
         else:
             self.meta_minnow = None
diff --git a/lib/oeqa/selftest/cases/updater_native.py b/lib/oeqa/selftest/cases/updater_native.py
index 1fc9cb8..d2bf341 100644
--- a/lib/oeqa/selftest/cases/updater_native.py
+++ b/lib/oeqa/selftest/cases/updater_native.py
@@ -14,6 +14,7 @@ class SotaToolsTests(OESelftestTestCase):
         logger = logging.getLogger("selftest")
         logger.info('Running bitbake to build aktualizr-native tools')
         bitbake('aktualizr-native')
+        bitbake('build-sysroots -c build_native_sysroot')
 
     def test_push_help(self):
         akt_native_run(self, 'garage-push --help')
diff --git a/lib/oeqa/selftest/cases/updater_qemux86_64.py b/lib/oeqa/selftest/cases/updater_qemux86_64.py
index 7223e9e..2b4726c 100644
--- a/lib/oeqa/selftest/cases/updater_qemux86_64.py
+++ b/lib/oeqa/selftest/cases/updater_qemux86_64.py
@@ -2,6 +2,7 @@
 import os
 import logging
 import re
+import subprocess
 import unittest
 from time import sleep
 from uuid import uuid4
@@ -9,7 +10,8 @@ from uuid import uuid4
 from oeqa.selftest.case import OESelftestTestCase
 from oeqa.utils.commands import runCmd, bitbake, get_bb_var, get_bb_vars
 from testutils import qemu_launch, qemu_send_command, qemu_terminate, \
-    akt_native_run, verifyNotProvisioned, verifyProvisioned, qemu_bake_image, qemu_boot_image
+    metadir, akt_native_run, verifyNotProvisioned, verifyProvisioned, \
+    qemu_bake_image, qemu_boot_image
 
 
 class GeneralTests(OESelftestTestCase):
@@ -17,6 +19,9 @@ class GeneralTests(OESelftestTestCase):
         logger = logging.getLogger("selftest")
         logger.info('Running bitbake to build core-image-minimal')
         self.append_config('SOTA_CLIENT_PROV = "aktualizr-shared-prov"')
+
+        # note: this also tests ostreepush/garagesign/garagecheck which are
+        # omitted from other test cases
         bitbake('core-image-minimal')
         credentials = get_bb_var('SOTA_PACKED_CREDENTIALS')
         # skip the test if the variable SOTA_PACKED_CREDENTIALS is not set
@@ -39,20 +44,18 @@ class AktualizrToolsTests(OESelftestTestCase):
         super(AktualizrToolsTests, cls).setUpClass()
         logger = logging.getLogger("selftest")
         logger.info('Running bitbake to build aktualizr-native tools')
-        bitbake('aktualizr-native')
+        bitbake('aktualizr-native aktualizr-device-prov')
+        bitbake('build-sysroots -c build_native_sysroot')
 
     def test_cert_provider_help(self):
         akt_native_run(self, 'aktualizr-cert-provider --help')
 
     def test_cert_provider_local_output(self):
-        logger = logging.getLogger("selftest")
-        logger.info('Running bitbake to build aktualizr-device-prov')
-        bitbake('aktualizr-device-prov')
         bb_vars = get_bb_vars(['SOTA_PACKED_CREDENTIALS', 'T'], 'aktualizr-native')
         creds = bb_vars['SOTA_PACKED_CREDENTIALS']
         temp_dir = bb_vars['T']
-        bb_vars_prov = get_bb_vars(['STAGING_DIR_HOST', 'libdir'], 'aktualizr-device-prov')
-        config = bb_vars_prov['STAGING_DIR_HOST'] + bb_vars_prov['libdir'] + '/sota/sota-device-cred.toml'
+        bb_vars_prov = get_bb_vars(['WORKDIR', 'libdir'], 'aktualizr-device-prov')
+        config = bb_vars_prov['WORKDIR'] + '/sysroot-destdir' + bb_vars_prov['libdir'] + '/sota/conf.d/20-sota-device-cred.toml'
 
         akt_native_run(self, 'aktualizr-cert-provider -c {creds} -r -l {temp} -g {config}'
                        .format(creds=creds, temp=temp_dir, config=config))
@@ -75,17 +78,13 @@ class SharedCredProvTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of luck.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
         self.append_config('MACHINE = "qemux86-64"')
         self.append_config('SOTA_CLIENT_PROV = " aktualizr-shared-prov "')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.qemu, self.s = qemu_launch(machine='qemux86-64')
 
     def tearDownLocal(self):
@@ -117,18 +116,14 @@ class ManualControlTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of like.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
         self.append_config('MACHINE = "qemux86-64"')
         self.append_config('SOTA_CLIENT_PROV = " aktualizr-shared-prov "')
         self.append_config('SYSTEMD_AUTO_ENABLE_aktualizr = "disable"')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.qemu, self.s = qemu_launch(machine='qemux86-64')
 
     def tearDownLocal(self):
@@ -161,20 +156,16 @@ class DeviceCredProvTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of luck.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
         self.append_config('MACHINE = "qemux86-64"')
         self.append_config('SOTA_CLIENT_PROV = " aktualizr-device-prov "')
         self.append_config('SOTA_DEPLOY_CREDENTIALS = "0"')
-        runCmd('bitbake -c cleanall aktualizr aktualizr-device-prov')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.qemu, self.s = qemu_launch(machine='qemux86-64')
+        bitbake('build-sysroots -c build_native_sysroot')
 
     def tearDownLocal(self):
         qemu_terminate(self.s)
@@ -201,8 +192,8 @@ class DeviceCredProvTests(OESelftestTestCase):
         # Run aktualizr-cert-provider.
         bb_vars = get_bb_vars(['SOTA_PACKED_CREDENTIALS'], 'aktualizr-native')
         creds = bb_vars['SOTA_PACKED_CREDENTIALS']
-        bb_vars_prov = get_bb_vars(['STAGING_DIR_HOST', 'libdir'], 'aktualizr-device-prov')
-        config = bb_vars_prov['STAGING_DIR_HOST'] + bb_vars_prov['libdir'] + '/sota/sota-device-cred.toml'
+        bb_vars_prov = get_bb_vars(['WORKDIR', 'libdir'], 'aktualizr-device-prov')
+        config = bb_vars_prov['WORKDIR'] + '/sysroot-destdir' + bb_vars_prov['libdir'] + '/sota/conf.d/20-sota-device-cred.toml'
 
         print('Provisining at root@localhost:%d' % self.qemu.ssh_port)
         akt_native_run(self, 'aktualizr-cert-provider -c {creds} -t root@localhost -p {port} -s -u -r -g {config}'
@@ -217,12 +208,7 @@ class DeviceCredProvHsmTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of luck.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
@@ -231,8 +217,9 @@ class DeviceCredProvHsmTests(OESelftestTestCase):
         self.append_config('SOTA_DEPLOY_CREDENTIALS = "0"')
         self.append_config('SOTA_CLIENT_FEATURES = "hsm"')
         self.append_config('IMAGE_INSTALL_append = " softhsm-testtoken"')
-        runCmd('bitbake -c cleanall aktualizr aktualizr-device-prov-hsm')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.qemu, self.s = qemu_launch(machine='qemux86-64')
+        bitbake('build-sysroots -c build_native_sysroot')
 
     def tearDownLocal(self):
         qemu_terminate(self.s)
@@ -269,25 +256,24 @@ class DeviceCredProvHsmTests(OESelftestTestCase):
         # Run aktualizr-cert-provider.
         bb_vars = get_bb_vars(['SOTA_PACKED_CREDENTIALS'], 'aktualizr-native')
         creds = bb_vars['SOTA_PACKED_CREDENTIALS']
-        bb_vars_prov = get_bb_vars(['STAGING_DIR_HOST', 'libdir'], 'aktualizr-device-prov-hsm')
-        config = bb_vars_prov['STAGING_DIR_HOST'] + bb_vars_prov['libdir'] + '/sota/sota-device-cred-hsm.toml'
+        bb_vars_prov = get_bb_vars(['WORKDIR', 'libdir'], 'aktualizr-device-prov-hsm')
+        config = bb_vars_prov['WORKDIR'] + '/sysroot-destdir' + bb_vars_prov['libdir'] + '/sota/conf.d/20-sota-device-cred-hsm.toml'
 
         akt_native_run(self, 'aktualizr-cert-provider -c {creds} -t root@localhost -p {port} -r -s -u -g {config}'
                        .format(creds=creds, port=self.qemu.ssh_port, config=config))
 
         # Verify that HSM is able to initialize.
-        ran_ok = False
         for delay in [5, 5, 5, 5, 10]:
             sleep(delay)
             p11_out, p11_err, p11_ret = self.qemu_command(pkcs11_command)
             hsm_out, hsm_err, hsm_ret = self.qemu_command(softhsm2_command)
-            if p11_ret == 0 and hsm_ret == 0 and hsm_err == b'':
-                ran_ok = True
+            if (p11_ret == 0 and hsm_ret == 0 and hsm_err == b'' and
+                    b'X.509 cert' in p11_out and b'present token' in p11_err):
                 break
-        self.assertTrue(ran_ok, 'pkcs11-tool or softhsm2-tool failed: ' + p11_err.decode() +
-                        p11_out.decode() + hsm_err.decode() + hsm_out.decode())
-        self.assertIn(b'present token', p11_err, 'pkcs11-tool failed: ' + p11_err.decode() + p11_out.decode())
-        self.assertIn(b'X.509 cert', p11_out, 'pkcs11-tool failed: ' + p11_err.decode() + p11_out.decode())
+        else:
+            self.fail('pkcs11-tool or softhsm2-tool failed: ' + p11_err.decode() +
+                      p11_out.decode() + hsm_err.decode() + hsm_out.decode())
+
         self.assertIn(b'Initialized:      yes', hsm_out, 'softhsm2-tool failed: ' +
                       hsm_err.decode() + hsm_out.decode())
         self.assertIn(b'User PIN init.:   yes', hsm_out, 'softhsm2-tool failed: ' +
@@ -328,8 +314,8 @@ class IpSecondaryTests(OESelftestTestCase):
             self.configure()
             qemu_bake_image(self.imagename)
 
-        def send_command(self, cmd):
-            stdout, stderr, retcode = qemu_send_command(self.qemu.ssh_port, cmd, timeout=60)
+        def send_command(self, cmd, timeout=60):
+            stdout, stderr, retcode = qemu_send_command(self.qemu.ssh_port, cmd, timeout=timeout)
             return str(stdout), str(stderr), retcode
 
         def __enter__(self):
@@ -344,7 +330,7 @@ class IpSecondaryTests(OESelftestTestCase):
         def wait_till_sshable(self):
             # qemu_send_command tries to ssh into the qemu VM and blocks until it gets there or timeout happens
             # so it helps us to block q control flow until the VM is booted and a target binary/daemon is running there
-            self.stdout, self.stderr, self.retcode = self.send_command(self.binaryname + ' --help')
+            self.stdout, self.stderr, self.retcode = self.send_command(self.binaryname + ' --help', timeout=300)
 
         def was_successfully_booted(self):
             return self.retcode == 0
@@ -399,16 +385,12 @@ class IpSecondaryTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of luck.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
 
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.primary = IpSecondaryTests.Primary(self)
         self.secondary = IpSecondaryTests.Secondary(self)
 
@@ -446,17 +428,13 @@ class ResourceControlTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of luck.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
         self.append_config('MACHINE = "qemux86-64"')
         self.append_config('SOTA_CLIENT_PROV = " aktualizr-shared-prov "')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
         self.append_config('IMAGE_INSTALL_append += " aktualizr-resource-control "')
         self.append_config('RESOURCE_CPU_WEIGHT_pn-aktualizr = "1000"')
         self.append_config('RESOURCE_MEMORY_HIGH_pn-aktualizr = "50M"')
@@ -476,10 +454,13 @@ class ResourceControlTests(OESelftestTestCase):
         ran_ok = False
         for delay in [5, 5, 5, 5]:
             sleep(delay)
-            stdout, stderr, retcode = self.qemu_command('systemctl --no-pager show aktualizr')
-            if retcode == 0 and b'ExecMainStatus=9' in stdout:
-                ran_ok = True
-                break
+            try:
+                stdout, stderr, retcode = self.qemu_command('systemctl --no-pager show aktualizr')
+                if retcode == 0 and b'ExecMainStatus=9' in stdout:
+                    ran_ok = True
+                    break
+            except subprocess.TimeoutExpired:
+                pass
         self.assertTrue(ran_ok, 'Aktualizr was not killed')
 
         self.assertIn(b'CPUWeight=1000', stdout, 'CPUWeight was not set correctly')
diff --git a/lib/oeqa/selftest/cases/updater_qemux86_64_ptest.py b/lib/oeqa/selftest/cases/updater_qemux86_64_ptest.py
index 0f0f491..e9a1a65 100644
--- a/lib/oeqa/selftest/cases/updater_qemux86_64_ptest.py
+++ b/lib/oeqa/selftest/cases/updater_qemux86_64_ptest.py
@@ -1,10 +1,9 @@
 # pylint: disable=C0111,C0325
-import os
 import re
 
 from oeqa.selftest.case import OESelftestTestCase
 from oeqa.utils.commands import runCmd
-from testutils import qemu_launch, qemu_send_command, qemu_terminate
+from testutils import metadir, qemu_launch, qemu_send_command, qemu_terminate
 
 
 class PtestTests(OESelftestTestCase):
@@ -13,12 +12,7 @@ class PtestTests(OESelftestTestCase):
         layer = "meta-updater-qemux86-64"
         result = runCmd('bitbake-layers show-layers')
         if re.search(layer, result.output) is None:
-            # Assume the directory layout for finding other layers. We could also
-            # make assumptions by using 'show-layers', but either way, if the
-            # layers we need aren't where we expect them, we are out of like.
-            path = os.path.abspath(os.path.dirname(__file__))
-            metadir = path + "/../../../../../"
-            self.meta_qemu = metadir + layer
+            self.meta_qemu = metadir() + layer
             runCmd('bitbake-layers add-layer "%s"' % self.meta_qemu)
         else:
             self.meta_qemu = None
@@ -26,7 +20,8 @@ class PtestTests(OESelftestTestCase):
         self.append_config('SYSTEMD_AUTO_ENABLE_aktualizr = "disable"')
         self.append_config('PTEST_ENABLED_pn-aktualizr = "1"')
         self.append_config('IMAGE_INSTALL_append += "aktualizr-ptest ptest-runner "')
-        self.qemu, self.s = qemu_launch(machine='qemux86-64')
+        self.append_config('IMAGE_FSTYPES_remove = "ostreepush garagesign garagecheck"')
+        self.qemu, self.s = qemu_launch(machine='qemux86-64', mem="256M")
 
     def tearDownLocal(self):
         qemu_terminate(self.s)
diff --git a/lib/oeqa/selftest/cases/updater_raspberrypi.py b/lib/oeqa/selftest/cases/updater_raspberrypi.py
index e976100..8efc941 100644
--- a/lib/oeqa/selftest/cases/updater_raspberrypi.py
+++ b/lib/oeqa/selftest/cases/updater_raspberrypi.py
@@ -7,6 +7,8 @@ import unittest
 from oeqa.selftest.case import OESelftestTestCase
 from oeqa.utils.commands import runCmd, bitbake, get_bb_var
 
+from testutils import metadir
+
 
 class RpiTests(OESelftestTestCase):
 
@@ -16,18 +18,13 @@ class RpiTests(OESelftestTestCase):
         layer_rpi = "meta-raspberrypi"
         layer_upd_rpi = "meta-updater-raspberrypi"
         result = runCmd('bitbake-layers show-layers')
-        # Assume the directory layout for finding other layers. We could also
-        # make assumptions by using 'show-layers', but either way, if the
-        # layers we need aren't where we expect them, we are out of luck.
-        path = os.path.abspath(os.path.dirname(__file__))
-        metadir = path + "/../../../../../"
         if re.search(layer_rpi, result.output) is None:
-            self.meta_rpi = metadir + layer_rpi
+            self.meta_rpi = metadir() + layer_rpi
             runCmd('bitbake-layers add-layer "%s"' % self.meta_rpi)
         else:
             self.meta_rpi = None
         if re.search(layer_upd_rpi, result.output) is None:
-            self.meta_upd_rpi = metadir + layer_upd_rpi
+            self.meta_upd_rpi = metadir() + layer_upd_rpi
             runCmd('bitbake-layers add-layer "%s"' % self.meta_upd_rpi)
         else:
             self.meta_upd_rpi = None
diff --git a/recipes-sota/aktualizr/aktualizr_git.bb b/recipes-sota/aktualizr/aktualizr_git.bb
index ec36ca2..5de341e 100644
--- a/recipes-sota/aktualizr/aktualizr_git.bb
+++ b/recipes-sota/aktualizr/aktualizr_git.bb
@@ -6,7 +6,7 @@ LICENSE = "MPL-2.0"
 LIC_FILES_CHKSUM = "file://${S}/LICENSE;md5=9741c346eef56131163e13b9db1241b3"
 
 DEPENDS = "boost curl openssl libarchive libsodium sqlite3 asn1c-native"
-DEPENDS_append = "${@bb.utils.contains('PTEST_ENABLED', '1', ' coreutils-native ostree-native aktualizr-native ', '', d)}"
+DEPENDS_append = "${@bb.utils.contains('PTEST_ENABLED', '1', ' coreutils-native net-tools-native ostree-native aktualizr-native ', '', d)}"
 RDEPENDS_${PN}_class-target = "aktualizr-configs lshw"
 RDEPENDS_${PN}-host-tools = "aktualizr aktualizr-repo aktualizr-cert-provider ${@bb.utils.contains('PACKAGECONFIG', 'sota-tools', 'garage-deploy garage-push', '', d)}"
 
diff --git a/scripts/ci/Dockerfile.bitbake b/scripts/ci/Dockerfile.bitbake
index c91f94c..51eaa57 100644
--- a/scripts/ci/Dockerfile.bitbake
+++ b/scripts/ci/Dockerfile.bitbake
@@ -1,15 +1,17 @@
-FROM debian:stable
+FROM debian:stretch
 LABEL Description="Image for bitbaking"
 
-RUN sed -i 's#deb http://deb.debian.org/debian stable main#deb http://deb.debian.org/debian stable main contrib#g' /etc/apt/sources.list
-RUN sed -i 's#deb http://deb.debian.org/debian stable-updates main#deb http://deb.debian.org/debian stable-updates main contrib#g' /etc/apt/sources.list
-RUN apt-get update -q && apt-get install -qy \
+RUN sed -i 's#deb http://deb.debian.org/debian stretch main#deb http://deb.debian.org/debian stretch main contrib#g' /etc/apt/sources.list
+RUN sed -i 's#deb http://deb.debian.org/debian stretch-updates main#deb http://deb.debian.org/debian stretch-updates main contrib#g' /etc/apt/sources.list
+RUN apt-get update -q && apt-get install --no-install-suggests --no-install-recommends -qy \
+     awscli \
      build-essential \
      bzip2 \
      chrpath \
      cpio \
      default-jre \
      diffstat \
+     file \
      gawk \
      gcc-multilib \
      git-core \
@@ -17,26 +19,40 @@ RUN apt-get update -q && apt-get install -qy \
      iproute \
      libpython-dev \
      libsdl1.2-dev \
+     libvirt-clients \
+     libvirt-daemon-system \
      locales \
      ovmf \
+     openssh-client \
      procps \
      python \
      python3 \
      python3-pexpect \
-     qemu \
+     qemu-kvm \
      socat \
+     sudo \
      texinfo \
      unzip \
      wget \
      xterm \
      xz-utils
 
-ARG uid=1000
-ARG gid=1000
+ARG uid=4321
+ARG gid=4321
 RUN groupadd -g $gid bitbake
-RUN useradd -m -u $uid -g $gid bitbake
+RUN useradd -m -u $uid -g $gid -s /bin/bash bitbake
 
 RUN echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && locale-gen
 ENV LC_ALL="en_US.UTF-8"
 ENV LANG="en_US.UTF-8"
 ENV LANGUAGE="en_US.UTF-8"
+
+# script to mirror kvm group id with host
+RUN echo "bitbake ALL=NOPASSWD: /usr/local/bin/setup_kvm.sh" >> /etc/sudoers
+COPY ./docker/setup_kvm.sh /usr/local/bin/setup_kvm.sh
+
+# other ci scripts
+RUN mkdir /scripts
+COPY configure.sh build.sh oe-selftest.sh /scripts/
+
+USER "bitbake"
diff --git a/scripts/ci/Dockerfile.checkout b/scripts/ci/Dockerfile.checkout
new file mode 100644
index 0000000..5210c6b
--- /dev/null
+++ b/scripts/ci/Dockerfile.checkout
@@ -0,0 +1,13 @@
+FROM debian:stretch-slim
+LABEL Description="Image for checking out updater-repo"
+
+RUN sed -i 's#deb http://deb.debian.org/debian stretch main#deb http://deb.debian.org/debian stretch main contrib#g' /etc/apt/sources.list
+RUN sed -i 's#deb http://deb.debian.org/debian stretch-updates main#deb http://deb.debian.org/debian stretch-updates main contrib#g' /etc/apt/sources.list
+RUN apt-get update -q && apt-get install -qy \
+    git \
+    repo \
+    xmlstarlet
+
+# checkout script
+RUN mkdir /scripts
+COPY checkout-oe.sh /scripts/
diff --git a/scripts/ci/build.sh b/scripts/ci/build.sh
index 6235428..9fbae98 100755
--- a/scripts/ci/build.sh
+++ b/scripts/ci/build.sh
@@ -12,7 +12,10 @@ IMAGE_NAME=${1:-core-image-minimal}
 (
 set +euo pipefail
 set +x
+METADIR=$(realpath "$TEST_REPO_DIR")
+export METADIR
 . "${TEST_REPO_DIR}/meta-updater/scripts/envsetup.sh" "${TEST_MACHINE}" "${TEST_BUILD_DIR}"
 
+set -x
 bitbake "${IMAGE_NAME}"
 )
diff --git a/scripts/ci/checkout-oe.sh b/scripts/ci/checkout-oe.sh
new file mode 100755
index 0000000..a99f235
--- /dev/null
+++ b/scripts/ci/checkout-oe.sh
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+set -x
+
+REMOTE_SOURCE=${REMOTE_SOURCE:-https://github.com/advancedtelematic}
+MANIFEST=${MANIFEST:-master}
+CURRENT_PROJECT=${CURRENT_PROJECT:-}
+
+# list of projects to pin to one version in the format:
+# "project:rev;project2:rev2..."
+PIN_LIST=${PIN_LIST:-}
+
+#CURRENT_REV=$(git rev-parse HEAD)
+LOCAL_REPO=$PWD
+
+mkdir -p updater-repo
+
+cd updater-repo
+
+repo init -m "${MANIFEST}.xml" -u "$REMOTE_SOURCE/updater-repo"
+
+git -C .repo/manifests reset --hard
+
+# patch manifest:
+# - add a new "ats" remote that points to "$REMOTE_SOURCE"
+# - change projects that contain "advancedtelematic" to use the ats remote
+MANIFEST_FILE=".repo/manifests/${MANIFEST}.xml"
+xmlstarlet ed --omit-decl -L \
+    -s "/manifest" -t elem -n "remote" -v "" \
+    -i "/manifest/remote[last()]" -t attr -n "name" -v "ats" \
+    -i "/manifest/remote[last()]" -t attr -n "fetch" -v "$REMOTE_SOURCE" \
+    -d "/manifest/project[contains(@name, 'advancedtelematic')]/@remote" \
+    -i "/manifest/project[contains(@name, 'advancedtelematic')]" -t attr -n "remote" -v "ats" \
+    "$MANIFEST_FILE"
+
+# hack: sed on `advancedtelematic/` names, to remove this unwanted prefix
+sed -i 's#name="advancedtelematic/#name="#g' "$MANIFEST_FILE"
+
+# pin projects from the list
+(
+IFS=";"
+for pin in $PIN_LIST; do
+    IFS=":"
+    read -r project rev <<< "$pin"
+    xmlstarlet ed --omit-decl -L \
+        -i "/manifest/project[@name=\"$project\"]/@revision" -t attr -n "revision" -v "$rev" \
+        -i "/manifest/project[@name=\"$project\"]" -t attr -n "revision" -v "$rev" \
+        "$MANIFEST_FILE"
+    IFS=";"
+done
+)
+
+# Remove the current project from the manifest if we have it checked out
+if [ -n "$CURRENT_PROJECT" ]; then
+    xmlstarlet ed --omit-decl -L \
+        -d "/manifest/project[@name=\"$CURRENT_PROJECT\"]" \
+        "$MANIFEST_FILE"
+fi
+
+repo manifest
+
+repo forall -c 'git reset --hard ; git clean -fdx'
+
+repo sync -d --force-sync
+
+if [ -n "$CURRENT_PROJECT" ]; then
+    rm -f "$CURRENT_PROJECT"
+    ln -s "$LOCAL_REPO" "$CURRENT_PROJECT"
+fi
+
+repo manifest -r
diff --git a/scripts/ci/configure.sh b/scripts/ci/configure.sh
index 960a0cc..a8968da 100755
--- a/scripts/ci/configure.sh
+++ b/scripts/ci/configure.sh
@@ -8,9 +8,13 @@ TEST_BUILD_DIR=${TEST_BUILD_DIR:-build}
 TEST_REPO_DIR=${TEST_REPO_DIR:-updater-repo}
 TEST_BITBAKE_COMMON_DIR=${TEST_BITBAKE_COMMON_DIR:-}
 
-TEST_AKTUALIZR_DIR=${TEST_AKTUALIZR_DIR:-.}
-TEST_AKTUALIZR_BRANCH=${TEST_AKTUALIZR_BRANCH:-master}
-TEST_AKTUALIZR_REV=${TEST_AKTUALIZR_REV:-$(GIT_DIR="$TEST_AKTUALIZR_DIR/.git" git rev-parse "$TEST_AKTUALIZR_REMOTE/$TEST_AKTUALIZR_BRANCH")}
+TEST_AKTUALIZR_REMOTE=${TEST_AKTUALIZR_REMOTE:-}
+if [ -n "$TEST_AKTUALIZR_REMOTE" ]; then
+    TEST_AKTUALIZR_DIR=${TEST_AKTUALIZR_DIR:-.}
+    TEST_AKTUALIZR_BRANCH=${TEST_AKTUALIZR_BRANCH:-master}
+    TEST_AKTUALIZR_REV=${TEST_AKTUALIZR_REV:-$(GIT_DIR="$TEST_AKTUALIZR_DIR/.git" git rev-parse "$TEST_AKTUALIZR_REMOTE/$TEST_AKTUALIZR_BRANCH")}
+fi
+
 TEST_AKTUALIZR_CREDENTIALS=${TEST_AKTUALIZR_CREDENTIALS:-}
 
 # move existing conf directory to backup, before generating a new one
@@ -21,6 +25,8 @@ mv "$TEST_BUILD_DIR/conf" "$TEST_BUILD_DIR/conf.old" || true
 set +euo pipefail
 set +x
 echo ">> Running envsetup.sh"
+METADIR=$(realpath "$TEST_REPO_DIR")
+export METADIR
 . "$TEST_REPO_DIR/meta-updater/scripts/envsetup.sh" "$TEST_MACHINE" "$TEST_BUILD_DIR"
 )
 
@@ -31,19 +37,19 @@ SITE_CONF="$TEST_BUILD_DIR/conf/site.conf"
 echo ">> Set common bitbake config options"
 cat << EOF > "$SITE_CONF"
 SANITY_TESTED_DISTROS = ""
-SSTATE_MIRRORS ?= "file://.* https://bitbake-cache.atsgarage.com/PATH;downloadfilename=PATH"
 IMAGE_FEATURES += "ssh-server-openssh"
 
 EOF
 
-echo ">> Set aktualizr branch in bitbake's config"
-cat << EOF >> "$SITE_CONF"
+if [ -n "$TEST_AKTUALIZR_REMOTE" ]; then
+    echo ">> Set aktualizr branch in bitbake's config"
+    cat << EOF >> "$SITE_CONF"
 SRCREV_pn-aktualizr = "$TEST_AKTUALIZR_REV"
 SRCREV_pn-aktualizr-native = "\${SRCREV_pn-aktualizr}"
 BRANCH_pn-aktualizr = "$TEST_AKTUALIZR_BRANCH"
 BRANCH_pn-aktualizr-native = "\${BRANCH_pn-aktualizr}"
-
 EOF
+fi
 
 if [[ -n $TEST_AKTUALIZR_CREDENTIALS ]]; then
     echo ">> Set aktualizr credentials"
diff --git a/scripts/ci/docker/setup_kvm.sh b/scripts/ci/docker/setup_kvm.sh
new file mode 100755
index 0000000..1ffbbf5
--- /dev/null
+++ b/scripts/ci/docker/setup_kvm.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+# This script makes the gid of the 'kvm' group to match the group
+# owner of '/dev/kvm'
+#
+# These two are not guaranteed to match when a docker image starts
+# with access to '/dev/kvm' that comes from the host
+
+set -euo pipefail
+
+kvm_gid=$(stat -c "%g" /dev/kvm)
+groupmod -g "$kvm_gid" kvm
+usermod -a -G kvm bitbake
+ln -s /bin/true /usr/bin/kvm-ok
diff --git a/scripts/ci/gitlab/checkout.yml b/scripts/ci/gitlab/checkout.yml
new file mode 100644
index 0000000..28c9177
--- /dev/null
+++ b/scripts/ci/gitlab/checkout.yml
@@ -0,0 +1,16 @@
+.bb_checkout:
+  # parameters:
+  #   - MANIFEST
+  #   - REMOTE_SOURCE
+  #   - CURRENT_PROJECT (will be symlinked instead of pulled)
+
+  image: $BITBAKE_CHECKOUT_IMAGE
+  cache:
+    paths:
+      - updater-repo
+  artifacts:
+    expire_in: "1 day"
+    paths:
+      - updater-repo
+  script:
+    - /scripts/checkout-oe.sh
diff --git a/scripts/ci/gitlab/docker.yml b/scripts/ci/gitlab/docker.yml
new file mode 100644
index 0000000..827bb47
--- /dev/null
+++ b/scripts/ci/gitlab/docker.yml
@@ -0,0 +1,37 @@
+.bb_docker_local:
+  # intended to be run on meta-updater's master branch which contains the
+  # reference docker files
+  # parameters:
+  #   - BITBAKE_IMAGE
+  #   - BITBAKE_CHECKOUT_IMAGE
+  #   - BITBKAE_IMAGE_MASTER
+  #   - BITBAKE_CHECKOUT_IMAGE_MASTER
+  image: docker:stable
+  stage: docker
+  services:
+    - docker:dind
+  before_script:
+    - docker login -u gitlab-ci-token -p "$CI_JOB_TOKEN" "$CI_REGISTRY"
+  script:
+    - docker pull "$BITBAKE_IMAGE" || docker pull "$BITBKAE_IMAGE_MASTER" || true
+    - docker build --pull --cache-from "$BITBKAE_IMAGE_MASTER" --cache-from "$BITBAKE_IMAGE" -f ./scripts/ci/Dockerfile.bitbake -t "$BITBAKE_IMAGE" ./scripts/ci
+    - docker push "$BITBAKE_IMAGE"
+
+    - docker pull "$BITBAKE_CHECKOUT_IMAGE" || docker pull "$BITBAKE_CHECKOUT_IMAGE_MASTER" || true
+    - docker build --pull --cache-from "$BITBAKE_CHECKOUT_IMAGE_MASTER" --cache-from "$BITBAKE_CHECKOUT_IMAGE" -f ./scripts/ci/Dockerfile.checkout -t "$BITBAKE_CHECKOUT_IMAGE" ./scripts/ci
+    - docker push "$BITBAKE_CHECKOUT_IMAGE"
+
+.bb_docker_remote:
+  # intended to be run on other branches and repos: just pulls the last master image
+  # parameters:
+  #   - BITBAKE_IMAGE
+  #   - BITBAKE_CHECKOUT_IMAGE
+  image: docker:stable
+  stage: docker
+  services:
+    - docker:dind
+  before_script:
+    - docker login -u gitlab-ci-token -p "$CI_JOB_TOKEN" "$CI_REGISTRY"
+  script:
+    - docker pull "$BITBAKE_IMAGE"
+    - docker pull "$BITBAKE_CHECKOUT_IMAGE"
diff --git a/scripts/ci/gitlab/tests.yml b/scripts/ci/gitlab/tests.yml
new file mode 100644
index 0000000..4bd5844
--- /dev/null
+++ b/scripts/ci/gitlab/tests.yml
@@ -0,0 +1,36 @@
+.bitbake:
+  # parameters:
+  #   - TEST_BUILD_DIR
+  #   - TEST_MACHINE (defaults to qemux86-64)
+  #   - BITBAKE_TARGETS
+  image: $BITBAKE_IMAGE
+  dependencies:
+    - Checkout
+  tags:
+    - bitbake
+  script:
+    - /scripts/configure.sh
+    - /scripts/build.sh $BITBAKE_TARGETS
+
+.oe-selftest:
+  # parameters:
+  #   - TEST_BUILD_DIR
+  #   - TEST_MACHINE (defaults to qemux86-64)
+  #   - OE_SELFTESTS
+  image: $BITBAKE_IMAGE
+  dependencies:
+    - Checkout
+  tags:
+    - bitbake
+  variables:
+    TEST_AKTUALIZR_CREDENTIALS: $CI_PROJECT_DIR/credentials.zip
+  before_script:
+    - aws s3 cp s3://ota-gitlab-ci/hereotaconnect_prod.zip credentials.zip
+    - sudo /usr/local/bin/setup_kvm.sh
+  script:
+    - |
+      # sg is needed after adding bitbake to the kvm group (see setup_kvm.sh)
+      sg kvm << EOS
+      /scripts/configure.sh
+      /scripts/oe-selftest.sh $OE_SELFTESTS
+      EOS
diff --git a/scripts/ci/oe-selftest.sh b/scripts/ci/oe-selftest.sh
index 3124cce..66b1fc9 100755
--- a/scripts/ci/oe-selftest.sh
+++ b/scripts/ci/oe-selftest.sh
@@ -12,7 +12,10 @@ TEST_REPO_DIR=${TEST_REPO_DIR:-updater-repo}
 (
 set +euo pipefail
 set +x
+METADIR=$(realpath "$TEST_REPO_DIR")
+export METADIR
 . "${TEST_REPO_DIR}/meta-updater/scripts/envsetup.sh" "${TEST_MACHINE}" "${TEST_BUILD_DIR}"
 
-oe-selftest -r updater
+set -x
+oe-selftest -r "$@"
 )
diff --git a/scripts/envsetup.sh b/scripts/envsetup.sh
index 6103cf6..5827bc2 100755
--- a/scripts/envsetup.sh
+++ b/scripts/envsetup.sh
@@ -21,7 +21,7 @@ if [[ $SOURCED -ne 1 ]]; then
   exit 1
 fi
 
-METADIR="${SOURCEDIR}/../.."
+METADIR=${METADIR:-${SOURCEDIR}/../..}
 
 if [[ ! -f "${BUILDDIR}/conf/local.conf" ]]; then
   source "$METADIR/poky/oe-init-build-env" "$BUILDDIR"
diff --git a/scripts/qemucommand.py b/scripts/qemucommand.py
index 1049d7c..3045b45 100644
--- a/scripts/qemucommand.py
+++ b/scripts/qemucommand.py
@@ -2,7 +2,7 @@ from os.path import exists, join, realpath, abspath
 from os import listdir
 import random
 import socket
-from subprocess import check_output, CalledProcessError
+from subprocess import check_output
 
 EXTENSIONS = {
     'intel-corei7-64': 'wic',
@@ -68,6 +68,10 @@ class QemuCommand(object):
             self.mac_address = random_mac()
         self.serial_port = find_local_port(8990)
         self.ssh_port = find_local_port(2222)
+        if args.mem:
+            self.mem = args.mem
+        else:
+            self.mem = "1G"
         if args.kvm is None:
             # Autodetect KVM using 'kvm-ok'
             try:
@@ -95,7 +99,7 @@ class QemuCommand(object):
             cmdline += ["-drive", "file=%s,if=ide,format=raw,snapshot=on" % self.image]
         cmdline += [
             "-serial", "tcp:127.0.0.1:%d,server,nowait" % self.serial_port,
-            "-m", "1G",
+            "-m", self.mem,
             "-usb",
             "-object", "rng-random,id=rng0,filename=/dev/urandom",
             "-device", "virtio-rng-pci,rng=rng0",
@@ -131,4 +135,3 @@ class QemuCommand(object):
             "-f", "qcow2",
             self.overlay]
         return cmdline
-
diff --git a/scripts/run-qemu-ota b/scripts/run-qemu-ota
index b2f55e9..de63297 100755
--- a/scripts/run-qemu-ota
+++ b/scripts/run-qemu-ota
@@ -26,6 +26,7 @@ def main():
                            dest='kvm', action='store_true', default=None)
     kvm_group.add_argument('--no-kvm', help='Disable KVM in QEMU',
                            dest='kvm', action='store_false')
+    parser.add_argument('--mem', default=None, help="Amount of memory the machine boots with")
     parser.add_argument('--no-gui', help='Disable GUI', action='store_true')
     parser.add_argument('--gdb', help='Export gdbserver port 2159 from the image', action='store_true')
     parser.add_argument('--pcap', default=None, help='Dump all network traffic')