unkin-agent
b9d45eff68
The buildkit_config setting does not exist in the plugin-docker-buildx build we run: the binary has no PLUGIN_BUILDKIT_CONFIG, so the block was dead YAML and `docker buildx create` ran without --config. The plugin only writes a buildkit.toml (pointing at /etc/docker/certs.d/<registry>/ca.crt) when `registry` is set, which is why the tag build pushed fine and the PR build had no CA. Set registry on every step and drop the dead block. The matrix also overrode BASE_IMAGE with the Docker Hub path, so CI never used the artifactapi remote that distro.env selects. Point it at artifactapi and have ci/check-distros.sh fail when a matrix value restating a distro.env key drifts from it.
container-base
The estate's base container images, one per distro, replacing what packer-images
built. Published as artifactapi.k8s.syd1.au.unkin.net/docker-internal/<image>:<version>
— the image name is the distro (almalinux9), the repo's single semver is the tag.
| distro | image | from |
|---|---|---|
alma9 |
almalinux9 |
dockerhub/library/almalinux:9 |
Each image bootstraps the internal CA, installs the estate dnf repository configuration pointed at artifactapi, and installs the base package set.
Adding a distro
distros/<name>/distro.env—BASE_IMAGE,IMAGE,CA_RPM_URL,CA_RPM_SHA256,PACKAGES.distros/<name>/yum.repos.d/*.repo— repository configuration for that distro.- One
includeentry in each of.woodpecker/{build,docker}.yaml.
The check-distros pre-commit hook fails if step 1 or 3 is incomplete.
CA bootstrap
unkin-ca-certificates lives in artifactapi, but the image cannot trust artifactapi
over HTTPS until it is installed. The package is therefore fetched over plain HTTP and
checked against CA_RPM_SHA256 before rpm -i; everything after that uses HTTPS. The
pinned hash is the pkgid checksum recorded for the file in the repo's own repodata
(repodata/repomd.xml → *-primary.xml.gz).
Make
make build # build every distro
make pre-commit # uvx pre-commit run --all-files
make build-alma9 # one distro
make patch|minor|major