unkin-agent
95f449a875
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/build-matrix/2 Pipeline was successful
ci/woodpecker/pr/build-matrix/3 Pipeline was successful
ci/woodpecker/pr/build-matrix/4 Pipeline was successful
ci/woodpecker/pr/build-matrix/1 Pipeline was successful
ci/woodpecker/pr/build Pipeline was successful
39 lines
1.6 KiB
Markdown
39 lines
1.6 KiB
Markdown
# container-base
|
|
|
|
The estate's base container images, one per distro, replacing what `packer-images`
|
|
built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version>`
|
|
— the image name is the distro (`almalinux9`), the repo's single semver is the tag.
|
|
|
|
| distro | image | from |
|
|
| --- | --- | --- |
|
|
| `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` |
|
|
| `fedora42` | `fedora42` | `dockerhub/library/fedora:42` |
|
|
| `fedora43` | `fedora43` | `dockerhub/library/fedora:43` |
|
|
| `fedora44` | `fedora44` | `dockerhub/library/fedora:44` |
|
|
|
|
Each image bootstraps the internal CA, installs the estate dnf repository
|
|
configuration pointed at artifactapi, and installs the base package set.
|
|
|
|
## Adding a distro
|
|
|
|
1. `distros/<name>/distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`.
|
|
2. `distros/<name>/yum.repos.d/*.repo` — repository configuration for that distro.
|
|
3. One `include` entry in each of `.woodpecker/{build-matrix,docker}.yaml`.
|
|
|
|
The `check-distros` pre-commit hook fails if step 1 or 3 is incomplete.
|
|
|
|
## CA bootstrap
|
|
|
|
`unkin-ca-certificates` lives in artifactapi, but the image cannot trust artifactapi
|
|
over HTTPS until it is installed. The package is therefore fetched over plain HTTP and
|
|
checked against `CA_RPM_SHA256` before `rpm -i`; everything after that uses HTTPS. The
|
|
pinned hash is the `pkgid` checksum recorded for the file in the repo's own repodata
|
|
(`repodata/repomd.xml` → `*-primary.xml.gz`).
|
|
|
|
## Make
|
|
|
|
make build # build every distro
|
|
make pre-commit # uvx pre-commit run --all-files
|
|
make build-alma9 # one distro
|
|
make patch|minor|major
|