unkin-agent
03ab698efa
A buildkit FROM does its own pull and ignores the nodes' containerd mirror, so every build was an uncached, rate-limited Docker Hub pull. - point BASE_IMAGE at dockerhub/library/almalinux:9 - drop the syntax directive, which pulled a frontend image from Docker Hub for features this Dockerfile does not use
36 lines
1.4 KiB
Markdown
36 lines
1.4 KiB
Markdown
# container-base
|
|
|
|
The estate's base container images, one per distro, replacing what `packer-images`
|
|
built. Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version>`
|
|
— the image name is the distro (`almalinux9`), the repo's single semver is the tag.
|
|
|
|
| distro | image | from |
|
|
| --- | --- | --- |
|
|
| `alma9` | `almalinux9` | `dockerhub/library/almalinux:9` |
|
|
|
|
Each image bootstraps the internal CA, installs the estate dnf repository
|
|
configuration pointed at artifactapi, and installs the base package set.
|
|
|
|
## Adding a distro
|
|
|
|
1. `distros/<name>/distro.env` — `BASE_IMAGE`, `IMAGE`, `CA_RPM_URL`, `CA_RPM_SHA256`, `PACKAGES`.
|
|
2. `distros/<name>/yum.repos.d/*.repo` — repository configuration for that distro.
|
|
3. One `include` entry in each of `.woodpecker/{build,test,docker}.yaml`.
|
|
|
|
`pre-commit.sh` fails if step 3 is forgotten.
|
|
|
|
## CA bootstrap
|
|
|
|
`unkin-ca-certificates` lives in artifactapi, but the image cannot trust artifactapi
|
|
over HTTPS until it is installed. The package is therefore fetched over plain HTTP and
|
|
checked against `CA_RPM_SHA256` before `rpm -i`; everything after that uses HTTPS. The
|
|
pinned hash is the `pkgid` checksum recorded for the file in the repo's own repodata
|
|
(`repodata/repomd.xml` → `*-primary.xml.gz`).
|
|
|
|
## Make
|
|
|
|
make build # build every distro
|
|
make test # build the test stage of every distro (assertions run in-image)
|
|
make build-alma9 # one distro
|
|
make patch|minor|major
|