container-base
The estate's base container images, one per distro, replacing what packer-images
built. Published as artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version>
— the image name is the distro (almalinux9), the repo's single semver is the tag.
| distro | image | from |
|---|---|---|
alma9 |
almalinux9 |
dockerhub/library/almalinux:9 |
fedora42 |
fedora42 |
dockerhub/library/fedora:42 |
fedora43 |
fedora43 |
dockerhub/library/fedora:43 |
fedora44 |
fedora44 |
dockerhub/library/fedora:44 |
Each image bootstraps the internal CA, installs the estate dnf repository configuration pointed at artifactapi, and installs the base package set.
Adding a distro
distros/<name>/distro.env—BASE_IMAGE,IMAGE,CA_RPM_URL,CA_RPM_SHA256,PACKAGES.distros/<name>/yum.repos.d/*.repo— repository configuration for that distro.- One
includeentry in each of.woodpecker/{build,docker}.yaml.
The check-distros pre-commit hook fails if step 1 or 3 is incomplete.
CA bootstrap
unkin-ca-certificates lives in artifactapi, but the image cannot trust artifactapi
over HTTPS until it is installed. The package is therefore fetched over plain HTTP and
checked against CA_RPM_SHA256 before rpm -i; everything after that uses HTTPS. The
pinned hash is the pkgid checksum recorded for the file in the repo's own repodata
(repodata/repomd.xml → *-primary.xml.gz).
Make
make build # build every distro
make pre-commit # uvx pre-commit run --all-files
make build-alma9 # one distro
make patch|minor|major