Failed to build in gitlab-ci

[nullromo]

I set up a raspberry pi and installed gitlab-runner on it. I was able to register it and trigger jobs using the shell executor. Here is my .gitlab-ci-yml file.

stages:
    - generate

generate:
    stage: generate
    tags: [rpi]
    variables:
        GIT_SUBMODULE_STRATEGY: recursive

    script:
        - cd rpi-image-gen
        - ./build.sh -o ../oss-gp-image/oss-gp-image.options

As you can see, it's very simple. Just go into the directory and run the build script with an options file.

However, here is the output from the job log:

$ cd rpi-image-gen
$ ./build.sh -o ../oss-gp-image/oss-gp-image.options
[19:02:10] Reading generic[6](https://gitlab.diconcloud.com/kkovacs/oss-gp-rpi-image-gen/-/jobs/72938#L6)4-apt-simple from /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/config with options [/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/oss-gp-image/oss-gp-image.options]
[19:02:12] IGDEVICE /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/device/pi5
[19:02:12] IGIMAGE /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/image/mbr/simple_dual
[19:02:12] IGPROFILE /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/profile/bookworm/apt-min64
[19:02:12] /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/image/mbr/simple_dual[pre-build.sh]
time="2025-03-04T19:02:12Z" level=error msg="cannot find UID/GID for user gitlab-runner: no subuid ranges found for user \"gitlab-runner\" in /etc/subuid - check rootless mode in man pages."
time="2025-03-04T19:02:12Z" level=warning msg="Using rootless single mapping into the namespace. This might break some images. Check /etc/subuid and /etc/subgid for adding sub*ids if not using a network user"
I: automatically chosen mode: root
I: chroot architecture arm64 is equal to the host's architecture
I: finding correct signed-by value...
I: automatically chosen format: directory
W: Download is performed unsandboxed as root as file /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/work/deb12-arm64-min/rootfs/var/lib/apt/lists/partial couldn't be accessed by user _apt
I: running --setup-hook in shell: sh -c 'bin/runner setup "${IGconf_sys_workdir}/rootfs"' exec /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/work/deb12-arm64-min/rootfs
I: running apt-get update...
I: downloading packages with apt...
I: extracting archives...
tar: ./var/local: Cannot change ownership to uid 0, gid 50: Invalid argument
tar: Exiting with failure status due to previous errors
E: tar --extract failed: 512
I: main() received signal PIPE: waiting for setup...
E: mmdebstrap failed to run
2025-03-04 19:02:55,[8](https://gitlab.diconcloud.com/kkovacs/oss-gp-rpi-image-gen/-/jobs/72938#L8)91 bdebstrap ERROR: mmdebstrap failed with exit code 25. See above for details.
[1[9](https://gitlab.diconcloud.com/kkovacs/oss-gp-rpi-image-gen/-/jobs/72938#L9):02:56] Error: [podman unshare bdebstrap --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/debian/bookworm/arm64/base-apt.yaml --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/rpi/debian/bookworm/apt.yaml --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/rpi/misc-utils.yaml --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/rpi/base/essential.yaml --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/rpi/boot-firmware.yaml --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/rpi/arm64/linux-image-v8.yaml --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/rpi/user-credentials.yaml --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/rpi/misc-skel.yaml --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/sys-apps/systemd-net-min.yaml --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/sys-apps/fake-hwclock.yaml --config /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta/net-misc/openssh-server.yaml --env IGconf_device_class=pi5 --env IGconf_device_hostname=raspberrypi --env IGconf_device_keyboard_keymap=gb --env IGconf_device_keyboard_layout=English (UK) --env IGconf_device_locale1=en_GB.UTF-8 --env IGconf_device_options=defaults --env IGconf_device_profile=bookworm/apt-min64 --env IGconf_device_ssh_user1=y --env IGconf_device_timezone=Europe/London --env IGconf_device_timezone_area=Europe --env IGconf_device_timezone_city=London --env IGconf_device_user1=ossgp --env IGconf_device_user1pass=ossgp --env IGconf_device_variant=none --env IGconf_image_boot_part_size=200% --env IGconf_image_compression=none --env IGconf_image_layout=mbr/simple_dual --env IGconf_image_name=deb[12](https://gitlab.diconcloud.com/kkovacs/oss-gp-rpi-image-gen/-/jobs/72938#L12)-arm64-min --env IGconf_image_options=defaults --env IGconf_image_root_part_size=300% --env IGconf_image_rootfs_type=ext4 --env IGconf_image_suffix=img --env IGconf_image_version=2025-03-04 --env IGconf_sbom_output_format=spdx-json --aptopt APT::Get::Purge true --aptopt Dir::Etc::TrustedParts /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/work/deb12-arm64-min/keys --env IGconf_sys_apt_keydir=/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/work/deb12-arm64-min/keys --env IGconf_sys_deploydir=/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/work/deb12-arm64-min/deploy --env IGconf_sys_outputdir=/home/gitlab-runner/builds/Ze[25](https://gitlab.diconcloud.com/kkovacs/oss-gp-rpi-image-gen/-/jobs/72938#L25)TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/work/deb12-arm64-min/artefacts --env IGconf_sys_workdir=/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/work/deb12-arm64-min --env IGTOP=/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen --env META_HOOKS=/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/meta-hooks --env RPI_TEMPLATES=/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/templates/rpi --env IGDEVICE=/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/device/pi5 --env IGIMAGE=/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/image/mbr/simple_dual --env IGPROFILE=/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/profile/bookworm/apt-min64 --env PATH=/home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/games:/usr/games --force --name deb12-arm64-min --hostname raspberrypi --output /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/work/deb12-arm64-min/artefacts --target /home/gitlab-runner/builds/Ze25TVGSq/0/kkovacs/oss-gp-rpi-image-gen/rpi-image-gen/work/deb12-arm64-min/rootfs --setup-hook bin/runner setup "${IGconf_sys_workdir}/rootfs" --essential-hook bin/runner essential "${IGconf_sys_workdir}/rootfs" --customize-hook bin/runner customize "${IGconf_sys_workdir}/rootfs" --cleanup-hook bin/runner cleanup "${IGconf_sys_workdir}/rootfs"] (1)
Cleaning up project directory and file based variables
Wi-Fi is currently blocked by rfkill.
Use raspi-config to set the country before use.
ERROR: Job failed: exit status 1

Not sure why tar is failing with ./var/local: Cannot change ownership to uid 0, gid 50: Invalid argument. I think maybe it has to do with the user, because uid 0 doesn't seem right... Any help is appreciated.

Also note that normal builds on this pi over interactive SSH work just fine, so things are installed properly.

EDIT: uid 0 means the root user. On my system, it appears uid 0 is root, and gid 50 is staff. Not sure what staff means here. I also tried adding the root user to group 50 (sudo usermod -a -G staff root), but that didn't seem to help.

[learmj]

it's very simple. Just go into the directory and run the build script with an options file.

Sure. But what environment is it running in? Container, other, ...?

rpi-image-gen uses linux namespace to achieve elevated privileges via podman. If it didn't do this, lots of things wouldn't work and you'd need to use sudo to invoke it (like pi-gen).

I suspect the problem is that when doing the tar extract in your context/environment, tar thinks it's root (e.g. a Docker container) because it tries to take the ownership information from the archive when running as uid 0 (root). As you can see, if running this locally on a pi this doesn't happen.

I suspect there is a broader problem here. And there is:

level=error msg="cannot find UID/GID for user gitlab-runner: no subuid ranges found for user "gitlab-runner" in /etc/subuid - check rootless mode in man pages."

and

level=warning msg="Using rootless single mapping into the namespace. This might break some images. Check /etc/subuid and /etc/subgid for adding sub*ids if not using a network user"

Using podman unshare requires applicable and valid values in /etc/subuid and /etc/subgid for the user running the build (gitlab-runner in your case). This is a container / environmental configuration problem. If you fix it, you'll be able to run rpi-image-gen in the environment.