unkin-agent
03ab698efa
A buildkit FROM does its own pull and ignores the nodes' containerd mirror, so every build was an uncached, rate-limited Docker Hub pull. - point BASE_IMAGE at dockerhub/library/almalinux:9 - drop the syntax directive, which pulled a frontend image from Docker Hub for features this Dockerfile does not use
1.4 KiB
container-base
The estate's base container images, one per distro, replacing what packer-images
built. Published as artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version>
— the image name is the distro (almalinux9), the repo's single semver is the tag.
| distro | image | from |
|---|---|---|
alma9 |
almalinux9 |
dockerhub/library/almalinux:9 |
Each image bootstraps the internal CA, installs the estate dnf repository configuration pointed at artifactapi, and installs the base package set.
Adding a distro
distros/<name>/distro.env—BASE_IMAGE,IMAGE,CA_RPM_URL,CA_RPM_SHA256,PACKAGES.distros/<name>/yum.repos.d/*.repo— repository configuration for that distro.- One
includeentry in each of.woodpecker/{build,test,docker}.yaml.
pre-commit.sh fails if step 3 is forgotten.
CA bootstrap
unkin-ca-certificates lives in artifactapi, but the image cannot trust artifactapi
over HTTPS until it is installed. The package is therefore fetched over plain HTTP and
checked against CA_RPM_SHA256 before rpm -i; everything after that uses HTTPS. The
pinned hash is the pkgid checksum recorded for the file in the repo's own repodata
(repodata/repomd.xml → *-primary.xml.gz).
Make
make build # build every distro
make test # build the test stage of every distro (assertions run in-image)
make build-alma9 # one distro
make patch|minor|major