From 5ca92e99dc0706c1dcda0edd29aec46a3ccdd851 Mon Sep 17 00:00:00 2001 From: Bruce Ashfield Date: Tue, 10 Feb 2026 19:10:52 +0000 Subject: container tasks: move network access out of build chain yocto-check-layer reports an error for any task between do_fetch and do_build that has network enabled. Two changes fix this: container-bundle.bbclass: Move do_fetch_containers from a standalone task into a do_fetch postfunc. When remote containers are configured, the anonymous function adds extend_recipe_sysroot as a do_fetch prefunc (so skopeo-native is available) and do_fetch_containers as a postfunc. Network access during do_fetch is permitted by the QA check. container-registry-index: Remove do_container_registry_index from the build dependency chain (drop "before do_build"). Registry push is a deployment action requiring explicit invocation: bitbake container-registry-index -c container_registry_index The default do_build task now prints usage instructions. Signed-off-by: Bruce Ashfield --- classes/container-bundle.bbclass | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) (limited to 'classes/container-bundle.bbclass') diff --git a/classes/container-bundle.bbclass b/classes/container-bundle.bbclass index 53b7b2f8..6f43149b 100644 --- a/classes/container-bundle.bbclass +++ b/classes/container-bundle.bbclass @@ -280,6 +280,12 @@ python __anonymous() { d.setVar('_PROCESSED_BUNDLES', ' '.join(processed_bundles)) d.setVar('_BUNDLE_RUNTIME', runtime) + # Remote containers are fetched during do_fetch (network is allowed there). + # extend_recipe_sysroot populates the native sysroot so skopeo is available. + if remote_urls: + d.appendVarFlag('do_fetch', 'prefuncs', ' extend_recipe_sysroot') + d.appendVarFlag('do_fetch', 'postfuncs', ' do_fetch_containers') + # Build service file map for custom service files # Format: container1=/path/to/file1;container2=/path/to/file2 service_mappings = [] @@ -324,7 +330,7 @@ python do_fetch_containers() { fetched_dir = os.path.join(workdir, 'fetched') os.makedirs(fetched_dir, exist_ok=True) - # Find skopeo in native sysroot (available after do_prepare_recipe_sysroot) + # Find skopeo in native sysroot (populated by extend_recipe_sysroot prefunc) # skopeo-native installs to sbindir, not bindir staging_sbindir = d.getVar('STAGING_SBINDIR_NATIVE') skopeo = os.path.join(staging_sbindir, 'skopeo') @@ -363,8 +369,9 @@ python do_fetch_containers() { bb.fatal(f"Failed to fetch container '{url}': {e}") } -do_fetch_containers[network] = "1" -addtask fetch_containers after do_prepare_recipe_sysroot before do_compile +# do_fetch_containers runs as a postfunc of do_fetch (set in __anonymous +# when remote containers are configured). This keeps network access within +# do_fetch where it is permitted by yocto-check-layer. do_compile() { set -e -- cgit v1.2.3-54-g00ecf