I'm not sure I like the idea of not using debootstrap, it does complicated crap that I'm pretty sure we don't want to have to reinvent and maintain here forever, what's the advantage?

I'm not sure I like the idea of not using debootstrap, it does complicated crap that I'm pretty sure we don't want to have to reinvent and maintain here forever, what's the advantage?

Much smaller images by default, since we have much larger control over what's installed. Also, we get to use apt's dependency resolution and caching for everything, we don't have to configure both tools to do the right thing, can use more than one mirror which debootstrap doesn't support, it's faster, ... .

The core limitation with debootstrap is that it's built around apt not being available on the host system, which means it has to (usually poorly) re-implement apt. Luckily, we're very much OK with running apt on the host system, and because of that, we're mostly hindered by debootstrap poorly re-implementing apt. We can get much more reliable behavior by just using apt instead of debootstrap.

The only things we have to take care of is setting up merged usr and extracting the essential debs so maintainer scripts can run properly. After that, we delegate everything to apt.

I tried the branch, something is getting lost along the way as there are no apt repos configured anymore

I tried the branch, something is getting lost along the way as there are no apt repos configured anymore

So I still really think we shouldn't configure repos by default. We don't do it for any other distro, and to keep things consistent we shouldn't do it for Debian/Ubuntu either.

mkosi is an image builder, and I'm sure we should focus on image based workflows, including image based updates, for which configured package manager repositories in the image aren't needed.

With these changes, we don't even install apt by default anymore in the produced Ubuntu and Debian images (which finally makes them consistent with the other distros where we don't install a package manager either), so putting repositories in the image just doesn't make sense anymore if you ask me.

Or think about other use cases like building an initrd, having apt or configured repositories in such an image doesn't make sense at all, so we shouldn't put them in there by default.

IIRC the others can initialize themselves, apt cannot. It's not good UX, and it's not how other image builders work so the result is surprising. Maybe add them only if apt is passed to the package list? That way for small images without apt there's no such config file

IIRC the others can initialize themselves, apt cannot. It's not good UX, and it's not how other image builders work so the result is surprising. Maybe add them only if apt is passed to the package list? That way for small images without apt there's no such config file

Can we please make an effort to get a package in Debian that installs the repositories then? e.g. a package debian-release that writes to /etc/apt/sources.list.d/xxx.list what we write in mkosi. We can do it in mkosi for now but we should have a plan to get rid of it.

Reworked to add the repositories if apt was installed.

Added some NEWS updates

IIRC the others can initialize themselves, apt cannot. It's not good UX, and it's not how other image builders work so the result is surprising. Maybe add them only if apt is passed to the package list? That way for small images without apt there's no such config file

Can we please make an effort to get a package in Debian that installs the repositories then? e.g. a package debian-release that writes to /etc/apt/sources.list.d/xxx.list what we write in mkosi. We can do it in mkosi for now but we should have a plan to get rid of it.

I don't think that's possible, as everything is uploaded to unstable, then migrates to testing, and eventually is promoted to stable, same identical binary package, so you cannot have a fixed configuration for one suite

IIRC the others can initialize themselves, apt cannot. It's not good UX, and it's not how other image builders work so the result is surprising. Maybe add them only if apt is passed to the package list? That way for small images without apt there's no such config file

Can we please make an effort to get a package in Debian that installs the repositories then? e.g. a package debian-release that writes to /etc/apt/sources.list.d/xxx.list what we write in mkosi. We can do it in mkosi for now but we should have a plan to get rid of it.

I don't think that's possible, as everything is uploaded to unstable, then migrates to testing, and eventually is promoted to stable, same identical binary package, so you cannot have a fixed configuration for one suite

This shouldn't be too hard. Have some concept of "distro version" and insert it into a template?
Not being able to install config as a static package seems so 90's.

IIRC the others can initialize themselves, apt cannot. It's not good UX, and it's not how other image builders work so the result is surprising. Maybe add them only if apt is passed to the package list? That way for small images without apt there's no such config file

Can we please make an effort to get a package in Debian that installs the repositories then? e.g. a package debian-release that writes to /etc/apt/sources.list.d/xxx.list what we write in mkosi. We can do it in mkosi for now but we should have a plan to get rid of it.

I don't think that's possible, as everything is uploaded to unstable, then migrates to testing, and eventually is promoted to stable, same identical binary package, so you cannot have a fixed configuration for one suite

This shouldn't be too hard. Have some concept of "distro version" and insert it into a template? Not being able to install config as a static package seems so 90's.

Nope, the only official way to differentiate between testing and unstable is the apt repositories configuration. Without it, you cannot tell which is which, hence you cannot install the right one.

W: No sandbox user '_apt' on the system, can not drop privileges
— is this something to worry about? Maybe we should provide the user to get rid of the warning even if it isn't strictly necessary.

W: No sandbox user '_apt' on the system, can not drop privileges
— is this something to worry about? Maybe we should provide the user to get rid of the warning even if it isn't strictly necessary.

The thing is, apt wants this user on the host system, so this would be something to fix in the packages providing apt. Instead, I modified the apt config to use root as the sandbox user. If you care about this, you can run mkosi unprivileged and in that case, root is already sandboxed as we'll be using a user namespace and it should be fine to use as the sandbox user. If you're running mkosi as root, it's full of holes anyway so using root as the sandbox user shouldn't be an issue either.

IIRC the others can initialize themselves, apt cannot. It's not good UX, and it's not how other image builders work so the result is surprising. Maybe add them only if apt is passed to the package list? That way for small images without apt there's no such config file

Can we please make an effort to get a package in Debian that installs the repositories then? e.g. a package debian-release that writes to /etc/apt/sources.list.d/xxx.list what we write in mkosi. We can do it in mkosi for now but we should have a plan to get rid of it.

I don't think that's possible, as everything is uploaded to unstable, then migrates to testing, and eventually is promoted to stable, same identical binary package, so you cannot have a fixed configuration for one suite

This shouldn't be too hard. Have some concept of "distro version" and insert it into a template? Not being able to install config as a static package seems so 90's.

Nope, the only official way to differentiate between testing and unstable is the apt repositories configuration. Without it, you cannot tell which is which, hence you cannot install the right one.

Yeah, this is exactly the problem to fix. Add VERSION_ID=/VERSION_CODENAME= fields to os-release, read the file when installing packages, and substitute {version} in apt.sources as appropriate.

IIRC the others can initialize themselves, apt cannot. It's not good UX, and it's not how other image builders work so the result is surprising. Maybe add them only if apt is passed to the package list? That way for small images without apt there's no such config file

Can we please make an effort to get a package in Debian that installs the repositories then? e.g. a package debian-release that writes to /etc/apt/sources.list.d/xxx.list what we write in mkosi. We can do it in mkosi for now but we should have a plan to get rid of it.

I don't think that's possible, as everything is uploaded to unstable, then migrates to testing, and eventually is promoted to stable, same identical binary package, so you cannot have a fixed configuration for one suite

This shouldn't be too hard. Have some concept of "distro version" and insert it into a template? Not being able to install config as a static package seems so 90's.

Nope, the only official way to differentiate between testing and unstable is the apt repositories configuration. Without it, you cannot tell which is which, hence you cannot install the right one.

Yeah, this is exactly the problem to fix. Add VERSION_ID=/VERSION_CODENAME= fields to os-release, read the file when installing packages, and substitute {version} in apt.sources as appropriate.

Nope, the VERSION_ID is testing/unstable intentionally https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1021663