Merge branch 'baseimage-split-build' into 'main'
Draft: Require using Containerfile for build, prep for more custom base images Closes tracker#55 See merge request fedora/bootc/base-images!74
This commit is contained in:
Colin Walters (Red Hat)
commit
8b3b1be698
|
|
@ -29,24 +29,52 @@ FROM quay.io/fedora/fedora:rawhide as repos
|
|||
FROM quay.io/fedora/fedora:41 as builder
|
||||
RUN dnf -y install rpm-ostree selinux-policy-targeted
|
||||
ARG MANIFEST=fedora-bootc.yaml
|
||||
COPY --from=repos /etc/dnf/vars /etc/dnf/vars
|
||||
COPY --from=repos /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-* /etc/pki/rpm-gpg
|
||||
# The input git repository has .repo files committed to git rpm-ostree has historically
|
||||
# emphasized that. But here, we are fetching the repos from the container base image.
|
||||
# So copy the source, and delete the hardcoded ones in git, and use the container base
|
||||
# image ones. We can drop the ones commited to git when we hard switch to Containerfile.
|
||||
|
||||
# Copy in the source code
|
||||
COPY . /src
|
||||
WORKDIR /src
|
||||
RUN rm -vf /src/*.repo
|
||||
COPY --from=repos /etc/yum.repos.d/*.repo /src
|
||||
|
||||
# Construct the base rootfs
|
||||
RUN --mount=type=cache,target=/workdir \
|
||||
--mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared \
|
||||
--mount=type=bind,from=repos,src=/,dst=/repos \
|
||||
rpm-ostree compose image --image-config fedora-bootc-config.json \
|
||||
--cachedir=/workdir --format=ociarchive --initialize ${MANIFEST} \
|
||||
--source-root=/repos /buildcontext/out.ociarchive
|
||||
--mount=type=bind,from=repos,src=/,dst=/repos <<EORUN
|
||||
set -xeuo pipefail
|
||||
# Synchronize the repo files (and RPM gpg keys, and DNF variables) from the "repos" image into our builder rootfs.
|
||||
for d in /etc/yum.repos.d /etc/pki/rpm-gpg /etc/dnf/vars; do
|
||||
rm -rf $d
|
||||
cp -a /repos${d} $d
|
||||
done
|
||||
|
||||
# For legacy reasons we need the .repo files here too in the context directory
|
||||
cp /etc/yum.repos.d/* .
|
||||
|
||||
mkdir /tmp-ostree
|
||||
ostree --repo=/tmp-ostree init --mode=bare-user
|
||||
rm /workdir/target-rootfs -rf
|
||||
rpm-ostree compose install --unified-core --cachedir=/workdir --repo=/tmp-ostree --source-root=/repos ${MANIFEST} /workdir/target-rootfs
|
||||
EORUN
|
||||
|
||||
# Add whatever you want here! e.g.
|
||||
# FROM quay.io/examplecorp/someartifact:latest as artifacts
|
||||
# COPY --from=artifacts /usr /usr
|
||||
|
||||
# Final steps: postprocess and commit, then generate an OCI archive
|
||||
RUN --mount=type=cache,target=/workdir --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared <<EORUN
|
||||
set -xeuo pipefail
|
||||
rpm-ostree compose commit --repo=/tmp-ostree --write-commitid-to=/tmp/commit.txt ${MANIFEST} /workdir/target-rootfs/rootfs
|
||||
rpm-ostree compose container-encapsulate --repo=/tmp-ostree --image-config fedora-bootc-config.json $(cat /tmp/commit.txt) oci-archive:/buildcontext/out.ociarchive
|
||||
EORUN
|
||||
# At this point we're done with the builder image and we have our OCI archive.
|
||||
|
||||
FROM oci-archive:./out.ociarchive
|
||||
# We've cargo culted this one around, xref https://pagure.io/fork/cverna/fedora-kiwi-descriptions/c/a12446bbe98404cb4b30d4b07505ecf71a88dfcb
|
||||
ENV container=oci
|
||||
# Required for systemd being the default entrypoint
|
||||
STOPSIGNAL SIGRTMIN+3
|
||||
# https://containers.github.io/bootc/bootc-images.html#standard-metadata-for-bootc-compatible-images
|
||||
LABEL containers.bootc 1
|
||||
# This is our recommended way to link between the base image and
|
||||
# a tool to make disk images.
|
||||
LABEL bootc.diskimage-builder quay.io/centos-bootc/bootc-image-builder
|
||||
# Need to reference builder here to force ordering. But since we have to run
|
||||
# something anyway, we might as well cleanup after ourselves.
|
||||
RUN --mount=type=bind,from=builder,src=.,target=/var/tmp \
|
||||
|
|
|
|||
|
|
@ -1,7 +0,0 @@
|
|||
# NB: This treefile is used by the legacy pungi path only to build tier-1. It
|
||||
# will be removed in the future.
|
||||
releasever: 40
|
||||
repos:
|
||||
- fedora
|
||||
- fedora-updates
|
||||
include: fedora-bootc.yaml
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
# NB: This treefile is used by the legacy pungi path only to build tier-1. It
|
||||
# will be removed in the future.
|
||||
releasever: 41
|
||||
repos:
|
||||
- fedora
|
||||
- fedora-updates
|
||||
include: fedora-bootc.yaml
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
{
|
||||
"Labels": {
|
||||
"containers.bootc": "1",
|
||||
"bootc.diskimage-builder": "quay.io/centos-bootc/bootc-image-builder",
|
||||
"redhat.id": "fedora",
|
||||
"redhat.version-id": "rawhide"
|
||||
},
|
||||
"StopSignal": "SIGRTMIN+3",
|
||||
"Env": [
|
||||
"container=oci"
|
||||
]
|
||||
}
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
# NB: This treefile is used by the legacy pungi path only to build tier-1. It
|
||||
# will be removed in the future.
|
||||
releasever: rawhide
|
||||
repos:
|
||||
- fedora-rawhide
|
||||
include: fedora-bootc.yaml
|
||||
102
fedora.repo
102
fedora.repo
|
|
@ -1,102 +0,0 @@
|
|||
# Note we use baseurl= here because using auto-selected mirrors conflicts with
|
||||
# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85.
|
||||
|
||||
[fedora]
|
||||
name=Fedora $releasever - $basearch
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/releases/$releasever/Everything/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Everything/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates]
|
||||
name=Fedora $releasever - $basearch - Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates-testing]
|
||||
name=Fedora $releasever - $basearch - Test Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-modular]
|
||||
name=Fedora Modular $releasever - $basearch
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/releases/$releasever/Modular/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Modular/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-modular-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates-modular]
|
||||
name=Fedora Modular $releasever - $basearch - Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Modular/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Modular/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-modular-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates-testing-modular]
|
||||
name=Fedora Modular $releasever - $basearch - Test Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Modular/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Modular/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[rawhide]
|
||||
name=Fedora - Rawhide - Developmental packages for the next Fedora release
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-devel]
|
||||
name=Fedora $releasever - $basearch
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
|
@ -1,4 +1,7 @@
|
|||
edition: "2024"
|
||||
# Basically we need to have a stub /etc/machine-id
|
||||
# so that Anaconda and especially `systemctl enable`
|
||||
# in our container builds do the right thing.
|
||||
# https://github.com/CentOS/centos-bootc/issues/167
|
||||
machineid-compat: true
|
||||
# Be minimal
|
||||
|
|
@ -14,7 +17,7 @@ etc-group-members:
|
|||
- systemd-journal
|
||||
- adm
|
||||
|
||||
# Default to `bash` in our container, the same as other containers we ship.
|
||||
# This is an opinionated default to run systemd.
|
||||
container-cmd:
|
||||
- /sbin/init
|
||||
|
||||
|
|
@ -52,10 +55,6 @@ include:
|
|||
packages:
|
||||
# this is implied by dependencies but let's make it explicit
|
||||
- coreutils
|
||||
# We need dnf for building derived container images. In Fedora, this pulls
|
||||
# in dnf5. In CentOS/RHEL, this pulls in dnf(4). We can simplify this back to
|
||||
# just `dnf` once the `dnf` package is retired from Fedora.
|
||||
- /usr/bin/dnf
|
||||
# Even in tier-0, we have this. If you don't want SELinux today, you'll need
|
||||
# to build a custom image.
|
||||
- selinux-policy-targeted
|
||||
|
|
|
|||
Loading…
Reference in New Issue