Merge pull request 'Put GOPATH/bin on PATH so go install-ed tools run' (#6 ) from container-gopath-bin into main

Reviewed-on: #6
Put GOPATH/bin on PATH so go install-ed tools run
2026-10-03 00:10:08 +10:00 · 2026-10-03 00:03:17 +10:00 · 2026-10-02 23:28:27 +10:00 · 2026-10-02 23:23:40 +10:00
2 changed files with 13 additions and 1 deletions
@@ -1,12 +1,19 @@
 ARG REGISTRY=artifactapi.k8s.syd1.au.unkin.net/docker-internal
 # The container-base release this image is built on — the one place to bump it.
-ARG BASE_VERSION=0.1.0
+ARG BASE_VERSION=0.1.3
 ARG BASE_IMAGE_NAME=almalinux9

 FROM ${REGISTRY}/${BASE_IMAGE_NAME}:${BASE_VERSION} AS image
 ARG DISTRO=alma9
 ARG GO_CACHE_PLUGIN_VERSION=v0.1.0
 ARG GO_CACHE_PLUGIN_SHA256=0eb23d06a0dcf395559cb6447864579c220e60148fdcd6a6f841c2b17169b9b8
+# `go install` writes to $GOPATH/bin, which nothing puts on PATH by default, so an
+# installed tool is not runnable. Match the official golang images: GOPATH out of root's
+# home, its bin on PATH, and world-writable so this still works if the image ever runs
+# as non-root.
+ENV GOPATH=/go
+ENV PATH=/go/bin:$PATH
+
 COPY distros/${DISTRO}/ /tmp/distro/
 # DL3041: versions are pinned by the estate dnf repos, not here. SC2086: $PACKAGES is a
 # word list on purpose. DL4006: the only pipe ends in sha256sum, whose status is the
@@ -20,5 +27,7 @@ RUN set -eux; \
      "https://git.unkin.net/unkin/go-cache-plugin/releases/download/${GO_CACHE_PLUGIN_VERSION}/go-cache-plugin-linux-amd64"; \
    echo "$GO_CACHE_PLUGIN_SHA256  /usr/local/bin/go-cache-plugin" | sha256sum -c -; \
    chmod 0755 /usr/local/bin/go-cache-plugin; \
+    mkdir -p "$GOPATH/bin"; \
+    chmod -R 1777 "$GOPATH"; \
    rm -rf /var/cache/dnf /tmp/distro
 CMD ["/bin/bash"]
@@ -13,6 +13,9 @@ Adds `golang`, `gcc` and `nfpm`, and bakes in the `go-cache-plugin` binary on `P
 so Go pipelines get the shared build cache with no download step. No credentials and no
 `GOCACHEPROG` value are baked in — consumers set those.

+`GOPATH` is `/go` with `/go/bin` on `PATH`, as on the official `golang` images, so a tool
+installed with `go install <tool>@<version>` is runnable by name in the same step.
+
 The `container-base` release this image builds on is `BASE_VERSION` in the `Dockerfile`.

 ## Adding a distro
Author	SHA1	Message	Date
benvin	8b87396475	Merge pull request 'Put GOPATH/bin on PATH so go install-ed tools run' (#6 ) from container-gopath-bin into main ci/woodpecker/tag/docker Pipeline was successful Details Reviewed-on: #6	2026-10-03 00:10:08 +10:00
unkin-agent	9269d71907	Put GOPATH/bin on PATH so go install-ed tools run ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details A step that runs `go install <tool>@<version>` and then invokes the tool fails with exit 127: the binary lands in $GOPATH/bin, which nothing adds to PATH, and GOPATH defaults to /root/go. Pipelines moving here from docker.io/golang, where /go/bin is on PATH, break on that difference. - Set GOPATH=/go and prepend /go/bin to PATH, matching the official golang images. - Create /go/bin mode 1777 so go install also works if the image runs as non-root. - Document the installed-tool contract in the README.	2026-10-03 00:03:17 +10:00
benvin	066e56ade8	Merge pull request 'Build on container-base almalinux9 0.1.3' (#5 ) from container-base-0-1-3 into main ci/woodpecker/tag/docker Pipeline was successful Details Reviewed-on: #5	2026-10-02 23:28:27 +10:00
unkin-agent	7b8dfe2663	Build on container-base almalinux9 0.1.3 ci/woodpecker/pr/pre-commit Pipeline was successful Details ci/woodpecker/pr/build Pipeline was successful Details The 0.1.0 base shipped only the root CA in unkin-ca-certificates, so s3.ceph.unkin.net — a bare leaf issued by the intermediate — failed to verify and the baked-in go-cache-plugin could never reach the shared build cache. 0.1.3 ships both anchors. - Bump BASE_VERSION to 0.1.3.	2026-10-02 23:23:40 +10:00