Docker multi-arch build with sudo support

[axelfontaine]

qemu-user-static-binfmt ships FP flags by default. Docker cross-arch builds run emulated-architecture containers via QEMU, and setuid binaries like sudo only keep their privilege escalation under binfmt_misc emulation when the C (credentials) flag is set; O (open-binary) lets the interpreter run against a container whose rootfs differs from the host's. Override with OCF, derived from the package's own registrations, and add a migration for existing installs.

Reproducer

Run a cross-arch Docker image build with a Dockerfile containing a USER directive and sudo:

FROM alpine:latest

RUN apk add --no-cache sudo && \
    adduser -D appuser && \
    echo "appuser ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

USER appuser

CMD ["sudo", "whoami"]

using the following command:

docker build --platform linux/arm64 -t sudo-test . && docker run --platform linux/arm64 --rm sudo-test

Before

It fails with:

sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?

After

It succeeds as expected and prints:

root

Notes

Supercedes #6074 and targets quattro

[Copilot]

Pull request overview

Adds QEMU binfmt overrides to support sudo in cross-architecture Docker containers.

Changes:

• Generates binfmt overrides with credential/open-binary flags.
• Applies configuration during installation.
• Migrates existing installations and reloads binfmt registrations.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
install/config/binfmt.sh	Generates QEMU binfmt overrides.
install/config/all.sh	Runs binfmt configuration during installation.
migrations/1786521494.sh	Repairs existing installations and restarts binfmt.

Suppressed comments (1)

install/config/binfmt.sh:9

• Replacing the entire suffix drops the package's existing P flag from its FP registrations. P preserves the emulated program's original argv[0]; removing it changes execution semantics for every QEMU-launched binary, beyond the intended credential fix. Preserve the package-supplied flags and add O/C instead, then make the migration's completion check accept the resulting flag set.

  sed -E 's/:[A-Za-z]*$/:OCF/' "$conf" >"/etc/binfmt.d/$(basename "$conf")"

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

test/shell.d/binfmt-multiarch-test.sh:34

• These expectations encode the unintended removal of the source registration's P flag. Assert an output that adds O and C while retaining F and P, so the test catches regressions in the package's argv0-preservation behavior.

grep -qFx ':qemu-aarch64:M::magic:mask:/usr/bin/qemu-aarch64-static:OCF' "$dest_dir/qemu-aarch64-static.conf" ||
  fail "binfmt config overrides aarch64 flags with OCF"
grep -qFx ':qemu-arm:M::magic:mask:/usr/bin/qemu-arm-static:OCF' "$dest_dir/qemu-arm-static.conf" ||
  fail "binfmt config overrides arm flags with OCF"