38 lines
1.5 KiB
Docker
38 lines
1.5 KiB
Docker
FROM artifactapi.k8s.syd1.au.unkin.net/dockerhub/library/fedora:44
|
|
|
|
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
|
|
|
|
# Internal CA over plain HTTP, pinned by the repodata pkgid; HTTPS after this.
|
|
ARG CA_RPM_URL="http://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/rpm-vendor-f44/Packages/unkin-ca-certificates-2026.10.2-1.fc44.x86_64.rpm"
|
|
ARG CA_RPM_SHA256="19929d13dd7a0542af3bf1dce736568b87159914b0261d7a9965edfd58dfc9cd"
|
|
# hadolint ignore=DL3041
|
|
RUN curl -fsSLo /tmp/ca.rpm "$CA_RPM_URL" \
|
|
&& echo "$CA_RPM_SHA256 /tmp/ca.rpm" | sha256sum -c - \
|
|
&& dnf install -y /tmp/ca.rpm \
|
|
&& rm /tmp/ca.rpm \
|
|
&& dnf clean all
|
|
|
|
# hadolint ignore=DL3041
|
|
RUN printf '%s\n' '[claude-code]' 'name=claude-code' \
|
|
'baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/claude-code/' \
|
|
'gpgcheck=0' >/etc/yum.repos.d/claude-code.repo \
|
|
&& dnf install -y --setopt=install_weak_deps=False \
|
|
bind-utils claude-code curl fuse-overlayfs git-core iproute jq less \
|
|
openssh-clients passt podman procps-ng \
|
|
&& dnf clean all
|
|
|
|
# No setuid binaries; nested rootless podman needs only newuidmap's file caps
|
|
# (lost in image layers) and subordinate ids inside keep-id's namespace.
|
|
RUN find / -xdev -type f -perm /6000 -exec chmod ug-s {} + \
|
|
&& rpm --setcaps shadow-utils \
|
|
&& useradd -u 1000 -m claude \
|
|
&& echo 'claude:1:999' >/etc/subuid \
|
|
&& echo 'claude:1001:64535' >>/etc/subuid \
|
|
&& cp /etc/subuid /etc/subgid
|
|
|
|
COPY containers.conf /etc/containers/containers.conf
|
|
|
|
USER 1000
|
|
WORKDIR /home/claude
|
|
CMD ["claude"]
|