Merge ~jugmac00/launchpad-buildd:add-information-about-architecture-on-production into launchpad-buildd:master

[Jürgen Gmach]

Add additional information about production architecture

[Guruprasad (lgp171188)]

review: Approve

[Guruprasad (lgp171188)]

Jürgen, can you fix the typo in the spelling of 'architecture' in your commit message? I have fixed it already in the 'Commit message' above in this MP.

[Jürgen Gmach (jugmac00)]

Thanks Guruprasad and Colin. I updated the wording in the documentation and the commit message.

I am waiting for some feedback from Colin on how to improve the last paragraph.

diff --git a/docs/explanation/deployment.rst b/docs/explanation/deployment.rst
index 1f0d3fa..29b5a88 100644
--- a/docs/explanation/deployment.rst
+++ b/docs/explanation/deployment.rst
@@ -1,5 +1,6 @@
+===========================
 Production deployment notes
-***************************
+===========================
 
 In Launchpad's production build farm, launchpad-buildd is deployed via base
 virtual machine images constructed by taking standard Ubuntu cloud images
@@ -8,3 +9,15 @@ https://launchpad.net/~canonical-is-sa/+archive/ubuntu/buildd.  This is done
 by
 https://code.launchpad.net/~canonical-sysadmins/canonical-is-charms/launchpad-buildd-image-modifier
 (currently private, sorry).
+
+We deliberately run builders in virtual machines rather than containers
+for the following reasons:
+
+- avoiding issues with nested containerization
+- containers are not secure enough against being escaped by malicious code
+
+------------------
+Additional context
+------------------
+
+Charm recipe builds, `Launchpad CI <https://help.launchpad.net/Code/ContinuousIntegration>`_, live filesystem builds, OCI recipe builds, and snap recipe builds all build in LXD containers.  Everything else builds in chroots.