257c791461
This is a small but notable step towards making the build process more container native. The rpm-ostree bits are hidden much more. We use a special trick specific to podman/buildah to do `FROM oci-archive` on an oci-archive that was built in a previous image stage. This lets us do things not possible in a Containerfile that is basically about total control over the image layers: - Output content-addressed reproducible "chunked" layers - Choose whether or not to use zstd for layers See discussion in e.g. https://github.com/coreos/rpm-ostree/issues/4688 Signed-off-by: Colin Walters <walters@verbum.org>
41 lines
2.3 KiB
Text
41 lines
2.3 KiB
Text
# This container build uses some special features of podman that allow
|
|
# a process executing as part of a container build to generate a new container
|
|
# image "from scratch".
|
|
#
|
|
# This container build uses nested containerization, so you must build with e.g.
|
|
# podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...>
|
|
#
|
|
# # Why are we doing this?
|
|
#
|
|
# Today this base image build process uses rpm-ostree. There is a lot of things that
|
|
# rpm-ostree does when generating a container image...but important parts include:
|
|
#
|
|
# - auto-updating labels in the container metadata
|
|
# - Generating "chunked" content-addressed reproducible image layers (notice
|
|
# how there are ~60 layers in the generated image)
|
|
#
|
|
# The latter bit in particular is currently impossible to do from Containerfile.
|
|
# A future goal is adding some support for this in a way that can be honored by
|
|
# buildah (xref https://github.com/containers/podman/discussions/12605)
|
|
#
|
|
# # Why does this build process require additional privileges?
|
|
#
|
|
# Because it's generating a base image and uses containerization features itself.
|
|
# In the future some of this can be lifted.
|
|
|
|
FROM quay.io/centos/centos:stream9 as repos
|
|
|
|
FROM quay.io/centos-bootc/bootc-image-builder:latest as builder
|
|
ARG MANIFEST=centos-bootc.yaml
|
|
# XXX: we should just make sure our in-tree c9s repo points to the c9s paths and doesn't require vars to avoid these steps entirely
|
|
COPY --from=repos /etc/dnf/vars /etc/dnf/vars
|
|
COPY --from=repos /etc/yum.repos.d/centos.repo c9s.repo
|
|
COPY --from=repos /etc/pki/rpm-gpg/RPM-GPG-KEY-centosofficial /etc/pki/rpm-gpg
|
|
# rpm-ostree doesn't honor /etc/dnf/vars right now
|
|
RUN for n in $(ls /etc/dnf/vars); do v=$(cat /etc/dnf/vars/$n); sed -ie s,\$${n},$v, c9s.repo; done
|
|
RUN --mount=type=cache,target=/workdir --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared rpm-ostree compose image --cachedir=/workdir --format=ociarchive --initialize /buildcontext/${MANIFEST} /buildcontext/out.ociarchive
|
|
|
|
FROM oci-archive:./out.ociarchive
|
|
# Need to reference builder here to force ordering. But since we have to run
|
|
# something anyway, we might as well cleanup after ourselves.
|
|
RUN --mount=type=bind,from=builder,src=.,target=/var/tmp --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared rm /buildcontext/out.ociarchive
|