unkin-agent
7b8dfe2663
The 0.1.0 base shipped only the root CA in unkin-ca-certificates, so s3.ceph.unkin.net — a bare leaf issued by the intermediate — failed to verify and the baked-in go-cache-plugin could never reach the shared build cache. 0.1.3 ships both anchors. - Bump BASE_VERSION to 0.1.3.
25 lines
1.1 KiB
Docker
25 lines
1.1 KiB
Docker
ARG REGISTRY=artifactapi.k8s.syd1.au.unkin.net/docker-internal
|
|
# The container-base release this image is built on — the one place to bump it.
|
|
ARG BASE_VERSION=0.1.3
|
|
ARG BASE_IMAGE_NAME=almalinux9
|
|
|
|
FROM ${REGISTRY}/${BASE_IMAGE_NAME}:${BASE_VERSION} AS image
|
|
ARG DISTRO=alma9
|
|
ARG GO_CACHE_PLUGIN_VERSION=v0.1.0
|
|
ARG GO_CACHE_PLUGIN_SHA256=0eb23d06a0dcf395559cb6447864579c220e60148fdcd6a6f841c2b17169b9b8
|
|
COPY distros/${DISTRO}/ /tmp/distro/
|
|
# DL3041: versions are pinned by the estate dnf repos, not here. SC2086: $PACKAGES is a
|
|
# word list on purpose. DL4006: the only pipe ends in sha256sum, whose status is the
|
|
# pipeline's, and set -e catches it.
|
|
# hadolint ignore=DL3041,DL4006,SC2086
|
|
RUN set -eux; \
|
|
. /tmp/distro/distro.env; \
|
|
dnf install -y $PACKAGES; \
|
|
dnf clean all; \
|
|
curl -fsSL -o /usr/local/bin/go-cache-plugin \
|
|
"https://git.unkin.net/unkin/go-cache-plugin/releases/download/${GO_CACHE_PLUGIN_VERSION}/go-cache-plugin-linux-amd64"; \
|
|
echo "$GO_CACHE_PLUGIN_SHA256 /usr/local/bin/go-cache-plugin" | sha256sum -c -; \
|
|
chmod 0755 /usr/local/bin/go-cache-plugin; \
|
|
rm -rf /var/cache/dnf /tmp/distro
|
|
CMD ["/bin/bash"]
|