mirror of
https://github.com/coreos/fedora-coreos-config.git
synced 2026-11-03 22:59:47 -09:00
73e10dd8d7
Those labels are required to comply with Red Hat Enterprise Contract (Conforma) policy downstream. They are not mandatory for Fedora though be we add values anyway. Initally, as those labels are for compliance, I wanted to set them in the Tekton task prepare-build-context but then, they would not be tied to the repo which is the source of truth. The alternative solution was to set them in the tekton pipeline in r-c-c, but then local and Konflux build would have a different result. With that solution we keep consistencty between f-c-c and r-c-c, and the same result between a local or Konflux build.
119 lines
5 KiB
Docker
119 lines
5 KiB
Docker
# To build this, run podman/buildah like this:
|
|
#
|
|
# podman build --security-opt=label=disable --cap-add=all --device /dev/fuse \
|
|
# --build-arg-file build-args.conf -v $PWD:/run/src . -t localhost/fedora-coreos
|
|
#
|
|
# Note: we should be able to drop the `-v $PWD:/run/src` once
|
|
# https://github.com/containers/buildah/issues/5952 is fixed.
|
|
#
|
|
# For development convenience, an `overrides/` directory in the context dir, or
|
|
# mounted at `/src/overrides` is supported:
|
|
# - The `overrides/rpm` directory can be a yum repo. Its packages take
|
|
# precedence over those from remote repos.
|
|
# - The `overrides/rootfs` directory can contain files in a rootfs layout which
|
|
# will be copied on top of the final rootfs.
|
|
|
|
# Overridden by build-args.conf. The value here is invalid on purpose.
|
|
ARG BUILDER_IMG=overridden
|
|
|
|
FROM ${BUILDER_IMG} as builder
|
|
|
|
ARG ID=overridden
|
|
ARG NAME=overridden
|
|
ARG VERSION=overridden
|
|
ARG DESCRIPTION=overridden
|
|
ARG STREAM=overridden
|
|
ARG MUTATE_OS_RELEASE=overridden
|
|
ARG MANIFEST=overridden
|
|
ARG IMAGE_CONFIG=overridden
|
|
# XXX: see inject_passwd_group() in build-rootfs
|
|
ARG PASSWD_GROUP_DIR
|
|
ARG STRICT_MODE=0
|
|
ARG INJECT_OPENSHIFT_VERSION_LABELS=""
|
|
ARG BUILDER_IMG_CHUNKER=""
|
|
ARG BUILDER_IMG_CHUNKER_MAX_LAYERS=""
|
|
|
|
COPY . /src
|
|
# canonicalize permission bits, see also https://gitlab.com/fedora/bootc/base-images/-/merge_requests/274
|
|
RUN chmod -R a=rX,u+w /src
|
|
|
|
# useful if you're hacking on rpm-ostree/bootc-base-imagectl
|
|
# COPY rpm-ostree /usr/bin/
|
|
# COPY bootc-base-imagectl /usr/libexec/
|
|
|
|
# always nuke any leftover libdnf lockfile from interrupted runs
|
|
RUN --mount=type=cache,rw,id=coreos-build-cache,target=/cache \
|
|
rm -rf /cache/cache/*lock*
|
|
RUN --mount=type=cache,rw,id=coreos-build-cache,target=/cache \
|
|
--mount=type=secret,id=container-image-build/yumrepos,target=/run/secrets/yumrepos \
|
|
--mount=type=secret,id=container-image-build/contentsets \
|
|
/src/build-rootfs --srcdir=/src make-rootfs --target-rootfs /target-rootfs
|
|
# Take the rootfs and created a chunked container out of it
|
|
RUN --mount=type=bind,target=/run/src,rw <<EOF
|
|
set -eux -o pipefail
|
|
EXTRA_ARGS=()
|
|
if [ -n "${INJECT_OPENSHIFT_VERSION_LABELS}" ]; then
|
|
EXTRA_ARGS+=(--label "io.openshift.build.versions=machine-os=${VERSION}")
|
|
EXTRA_ARGS+=(--label "io.openshift.build.version-display-names=machine-os=${DESCRIPTION}")
|
|
fi
|
|
case "${BUILDER_IMG_CHUNKER:-}" in
|
|
'chunkah')
|
|
# The '--prune /sysroot/ --label ostree.commit- --label ostree.final-diffid-'
|
|
# will strip OSTree data and labels for bootc compatibility; see
|
|
# https://github.com/coreos/chunkah#compatibility-with-bootable-bootc-images
|
|
chunkah build --rootfs /target-rootfs \
|
|
--prune /sysroot/ --label ostree.commit- --label ostree.final-diffid- \
|
|
--output oci-archive:/run/src/out.ociarchive \
|
|
--label com.coreos.inputhash=$(cat /run/inputhash) \
|
|
${BUILDER_IMG_CHUNKER_MAX_LAYERS:+--max-layers=${BUILDER_IMG_CHUNKER_MAX_LAYERS}} \
|
|
"${EXTRA_ARGS[@]}"
|
|
;;
|
|
"")
|
|
rpm-ostree experimental compose build-chunked-oci \
|
|
--bootc --format-version=1 --rootfs /target-rootfs \
|
|
--output oci-archive:/run/src/out.ociarchive \
|
|
--label com.coreos.inputhash=$(cat /run/inputhash) \
|
|
"${EXTRA_ARGS[@]}"
|
|
;;
|
|
*)
|
|
echo "error: unknown BUILDER_IMG_CHUNKER value: ${BUILDER_IMG_CHUNKER}" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
EOF
|
|
|
|
FROM oci-archive:./out.ociarchive
|
|
ARG VERSION
|
|
ARG NAME=overridden
|
|
ARG STREAM=overridden
|
|
ARG DESCRIPTION=overridden
|
|
ARG MAINTAINER=overridden
|
|
ARG VENDOR=overridden
|
|
ARG URL=overridden
|
|
ARG DISTRIBUTION_SCOPE=overridden
|
|
ARG COMPONENT=overridden
|
|
ARG CPE_NAME=overridden
|
|
# Need to reference builder here to force ordering. But since we have to run
|
|
# something anyway, we might as well cleanup after ourselves.
|
|
RUN --mount=type=bind,from=builder,target=/var/tmp \
|
|
--mount=type=bind,target=/run/src,rw \
|
|
rm /run/src/out.ociarchive
|
|
|
|
LABEL containers.bootc=1 \
|
|
ostree.bootable=1 \
|
|
org.opencontainers.image.version=$VERSION \
|
|
com.coreos.osname=$NAME \
|
|
name=$NAME \
|
|
com.coreos.stream=$STREAM \
|
|
org.opencontainers.image.title=$DESCRIPTION \
|
|
org.opencontainers.image.description=$DESCRIPTION \
|
|
io.k8s.description=$DESCRIPTION \
|
|
description=$DESCRIPTION \
|
|
maintainer=$MAINTAINER \
|
|
vendor=$VENDOR \
|
|
url=$URL \
|
|
distribution-scope=$DISTRIBUTION_SCOPE \
|
|
com.redhat.component=$COMPONENT \
|
|
cpe=$CPE_NAME
|
|
STOPSIGNAL SIGRTMIN+3
|
|
CMD ["/sbin/init"]
|