From 029e4c7038c5317284a112563707eff1a22ab05e Mon Sep 17 00:00:00 2001
From: Colin Walters <walters@verbum.org>
Date: Tue, 21 Jan 2025 11:27:54 -0500
Subject: [PATCH] Split off Containerfile.base

Signed-off-by: Colin Walters <walters@verbum.org>
---
 Containerfile      | 54 ----------------------------------------------
 Containerfile.base | 41 +++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 54 deletions(-)
 delete mode 100644 Containerfile
 create mode 100644 Containerfile.base

diff --git a/Containerfile b/Containerfile
deleted file mode 100644
index f512548..0000000
--- a/Containerfile
+++ /dev/null
@@ -1,54 +0,0 @@
-# This container build uses some special features of podman that allow
-# a process executing as part of a container build to generate a new container
-# image "from scratch".
-#
-# This container build uses nested containerization, so you must build with e.g.
-# podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...>
-#
-# # Why are we doing this?
-#
-# Today this base image build process uses rpm-ostree.  There is a lot of things that
-# rpm-ostree does when generating a container image...but important parts include:
-#
-# - auto-updating labels in the container metadata
-# - Generating "chunked" content-addressed reproducible image layers (notice
-#   how there are ~60 layers in the generated image)
-#
-# The latter bit in particular is currently impossible to do from Containerfile.
-# A future goal is adding some support for this in a way that can be honored by
-# buildah (xref https://github.com/containers/podman/discussions/12605)
-#
-# # Why does this build process require additional privileges?
-#
-# Because it's generating a base image and uses containerization features itself.
-# In the future some of this can be lifted.
-
-FROM quay.io/fedora/fedora:rawhide as repos
-
-# BOOTSTRAPPING: This can be any image that has rpm-ostree and selinux-policy-targeted.
-FROM quay.io/fedora/fedora:rawhide as builder
-RUN dnf -y install rpm-ostree selinux-policy-targeted
-ARG MANIFEST=fedora-bootc.yaml
-COPY --from=repos /etc/dnf/vars /etc/dnf/vars
-COPY --from=repos /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-* /etc/pki/rpm-gpg
-# The input git repository has .repo files committed to git rpm-ostree has historically
-# emphasized that.  But here, we are fetching the repos from the container base image.
-# So copy the source, and delete the hardcoded ones in git, and use the container base
-# image ones.  We can drop the ones commited to git when we hard switch to Containerfile.
-COPY . /src
-WORKDIR /src
-RUN rm -vf /src/*.repo
-COPY --from=repos /etc/yum.repos.d/*.repo /src
-RUN --mount=type=cache,target=/workdir \
-    --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared \
-    --mount=type=bind,from=repos,src=/,dst=/repos \
-      rpm-ostree compose image --image-config fedora-bootc-config.json \
-        --cachedir=/workdir --format=ociarchive --initialize ${MANIFEST} \
-       --source-root=/repos /buildcontext/out.ociarchive
-
-FROM oci-archive:./out.ociarchive
-# Need to reference builder here to force ordering. But since we have to run
-# something anyway, we might as well cleanup after ourselves.
-RUN --mount=type=bind,from=builder,src=.,target=/var/tmp \
-    --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared \
-      rm /buildcontext/out.ociarchive
diff --git a/Containerfile.base b/Containerfile.base
new file mode 100644
index 0000000..1cba2b7
--- /dev/null
+++ b/Containerfile.base
@@ -0,0 +1,41 @@
+# This is a relatively minimal base image build; it's intended as a derivation
+# point.
+#
+# This container build uses nested containerization to construct
+# a target rootfs from scratch; so you must build with e.g.
+# podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...>
+
+# If you want to configure the input rpm-md repositories, just override this
+# container image.
+FROM quay.io/fedora/fedora:rawhide as repos
+
+# BOOTSTRAPPING: This can be any image that has rpm-ostree and selinux-policy-targeted.
+FROM quay.io/fedora/fedora:rawhide as builder
+RUN dnf -y install rpm-ostree selinux-policy-targeted
+# Change the input manifest if desired, but this is discouraged.
+ARG MANIFEST=fedora-tier-0.yaml
+# Copy in our source code.
+COPY . /src
+WORKDIR /src
+RUN --mount=type=cache,target=/workdir \
+    --mount=type=bind,from=repos,target=/repos \
+    --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared \
+    --mount=type=bind,from=repos,src=/,dst=/repos <<EORUN
+set -xeuo pipefail
+# Synchronize the dnf/rpm configs from the repos container.
+for x in /etc/dnf /etc/yum.repos.d /etc/pki/rpm-gpg; do
+  rm -vf "$x" && cp -a /repos/$x $x
+done
+cp - /repos/etc/dnf/vars /etc/dnf/vars
+rpm-ostree compose image --image-config fedora-bootc-config.json \
+    --cachedir=/workdir --format=ociarchive --initialize ${MANIFEST} \
+    --source-root=/repos /buildcontext/out.ociarchive
+EORUN
+
+# This pulls in the OCI archive generated in the previous step.
+FROM oci-archive:./out.ociarchive
+# Need to reference builder here to force ordering. But since we have to run
+# something anyway, we might as well cleanup after ourselves.
+RUN --mount=type=bind,from=builder,src=.,target=/var/tmp \
+    --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared \
+      rm /buildcontext/out.ociarchive