Add matrixed container base image build #1

2026-09-27T17:47:34+10:00

unkin-agent commented

2026-09-27 17:47:34 +10:00

packer-images builds the estate base images from Packer rootfs tarballs, slow and pinned to a hand-rolled CA bootstrap against a hardcoded Gitea file id. This replaces it with a Dockerfile matrix over distros/, one image per distro on a single repo semver.

build docker-internal/<distro>:<version> from dockerhub/library/almalinux:9 via artifactapi
bootstrap the internal CA from a sha256-pinned rpm over plain HTTP, HTTPS after
install the estate dnf repo configuration pointed at artifactapi
lint with pre-commit.com (hadolint, shellcheck) plus a local hook holding distros/ to the Woodpecker matrices
add build/pre-commit PR workflows and a tag-triggered docker release

Adding a distro is one distros/<name>/ dir plus one matrix entry. Tests land separately.

packer-images builds the estate base images from Packer rootfs tarballs, slow and pinned to a hand-rolled CA bootstrap against a hardcoded Gitea file id. This replaces it with a Dockerfile matrix over `distros/`, one image per distro on a single repo semver. - build `docker-internal/<distro>:<version>` from `dockerhub/library/almalinux:9` via artifactapi - bootstrap the internal CA from a sha256-pinned rpm over plain HTTP, HTTPS after - install the estate dnf repo configuration pointed at artifactapi - lint with pre-commit.com (hadolint, shellcheck) plus a local hook holding `distros/` to the Woodpecker matrices - add `build`/`pre-commit` PR workflows and a tag-triggered `docker` release Adding a distro is one `distros/<name>/` dir plus one matrix entry. Tests land separately.

unkin-agent added 1 commit 2026-09-27 17:47:34 +10:00

Add matrixed container base image build 970cfad2ee

Replace the packer-images almalinux base with a Dockerfile matrix over distros/,
publishing one image per distro to docker-internal on a single repo semver.

- bootstrap the internal CA from a sha256-pinned rpm fetched over plain HTTP
- install the estate dnf repo configuration pointed at artifactapi
- run in-image assertions as a --target test build stage
- add pull_request build/test/pre-commit and tag-triggered docker workflows

unkin-agent added 1 commit 2026-09-27 18:07:07 +10:00

Take the estate repo name from distro.env

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

b3f46a715a

Keeps the test assertions distro-agnostic so a non-el9 matrix entry needs no
script edit.

unkin-agent added 1 commit 2026-09-27 18:37:19 +10:00

Pull the base image through the artifactapi dockerhub remote

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

03ab698efa

A buildkit FROM does its own pull and ignores the nodes' containerd mirror, so
every build was an uncached, rate-limited Docker Hub pull.

- point BASE_IMAGE at dockerhub/library/almalinux:9
- drop the syntax directive, which pulled a frontend image from Docker Hub for
  features this Dockerfile does not use

unkin-agent added 1 commit 2026-09-27 20:17:08 +10:00

Replace pre-commit.sh with the pre-commit framework and drop the test harness

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

63cf28c90e

The hand-rolled pre-commit.sh reimplemented what upstream hooks already do.
Move to pre-commit.com with the estate's usual pre-commit-hooks set plus
hadolint and shellcheck, and keep the one check with no upstream equivalent
(distros/ vs the Woodpecker matrices) as a repo: local hook.

The test harness goes; tests will be reintroduced differently.

- add .pre-commit-config.yaml and ci/check-distros.sh
- delete pre-commit.sh, test.sh and .woodpecker/test.yaml
- run uvx pre-commit run --all-files from .woodpecker/pre-commit.yaml and make pre-commit
- drop the Dockerfile test stage and the make test targets

benvin merged commit 1a4ea9d623 into main

2026-09-27 21:56:52 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/container-base#1