# container-base

The estate's base container images, one per distro, replacing what `packer-images`
built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version>`
— the image name is the distro (`almalinux9`), the repo's single semver is the tag.

| distro | image | from |
| --- | --- | --- |
| `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` |
| `fedora42` | `fedora42` | `dockerhub/library/fedora:42` |
| `fedora43` | `fedora43` | `dockerhub/library/fedora:43` |
| `fedora44` | `fedora44` | `dockerhub/library/fedora:44` |

Each image bootstraps the internal CA, installs the estate dnf repository
configuration pointed at artifactapi, and installs the base package set.

## Adding a distro

1. `distros/<name>/distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`.
2. `distros/<name>/yum.repos.d/*.repo` — repository configuration for that distro.
3. One `include` entry in each of `.woodpecker/{build-matrix,docker}.yaml`.

The `check-distros` pre-commit hook fails if step 1 or 3 is incomplete.

## CA bootstrap

`unkin-ca-certificates` lives in artifactapi, but the image cannot trust artifactapi
over HTTPS until it is installed. The package is therefore fetched over plain HTTP and
checked against `CA_RPM_SHA256` before `rpm -i`; everything after that uses HTTPS. The
pinned hash is the `pkgid` checksum recorded for the file in the repo's own repodata
(`repodata/repomd.xml` → `*-primary.xml.gz`).

## Make

    make build          # build every distro
    make pre-commit     # uvx pre-commit run --all-files
    make build-alma9    # one distro
    make patch|minor|major