|
| 1 | +# This container build uses some special features of podman that allow |
| 2 | +# a process executing as part of a container build to generate a new container |
| 3 | +# image "from scratch". |
| 4 | +# |
| 5 | +# This container build uses nested containerization, so you must build with e.g. |
| 6 | +# podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...> |
| 7 | +# |
| 8 | +# # Why are we doing this? |
| 9 | +# |
| 10 | +# Today this base image build process uses rpm-ostree. There is a lot of things that |
| 11 | +# rpm-ostree does when generating a container image...but important parts include: |
| 12 | +# |
| 13 | +# - auto-updating labels in the container metadata |
| 14 | +# - Generating "chunked" content-addressed reproducible image layers (notice |
| 15 | +# how there are ~60 layers in the generated image) |
| 16 | +# |
| 17 | +# The latter bit in particular is currently impossible to do from Containerfile. |
| 18 | +# A future goal is adding some support for this in a way that can be honored by |
| 19 | +# buildah (xref https://github.com/containers/podman/discussions/12605) |
| 20 | +# |
| 21 | +# # Why does this build process require additional privileges? |
| 22 | +# |
| 23 | +# Because it's generating a base image and uses containerbuildcontextization features itself. |
| 24 | +# In the future some of this can be lifted. |
| 25 | + |
| 26 | +FROM quay.io/fedora/fedora:40 as repos |
| 27 | + |
| 28 | +FROM quay.io/centos-bootc/bootc-image-builder:latest as builder |
| 29 | +ARG MANIFEST=fedora-bootc.yaml |
| 30 | +COPY --from=repos /etc/dnf/vars /etc/dnf/vars |
| 31 | +COPY --from=repos /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-* /etc/pki/rpm-gpg |
| 32 | +COPY . /src |
| 33 | +RUN rm -vf /src/*.repo |
| 34 | +COPY --from=repos /etc/yum.repos.d/*.repo /src |
| 35 | +RUN --mount=type=cache,target=/workdir --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared rpm-ostree compose image \ |
| 36 | + --image-config /buildcontext/fedora-bootc-config.json --cachedir=/workdir --format=ociarchive --initialize /src/${MANIFEST} /buildcontext/out.ociarchive |
| 37 | + |
| 38 | +FROM oci-archive:./out.ociarchive |
| 39 | +# Need to reference builder here to force ordering. But since we have to run |
| 40 | +# something anyway, we might as well cleanup after ourselves. |
| 41 | +RUN --mount=type=bind,from=builder,src=.,target=/var/tmp --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared rm /buildcontext/out.ociarchive |
0 commit comments