varve/Containerfile.worker at main · shkouyo/varve · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# Build container image for the varve worker. Both worker forms
# (host-launched one-shot containers and Actions pool containers) run this
# image; the agent binary inside performs builds.

FROM archlinux/archlinux:multilib-devel

# Carry our own OCI metadata instead of inheriting the base image's.
# version/revision/created/documentation are cleared so no Arch Linux
# information leaks into the published image.
LABEL org.opencontainers.image.title="Varve Worker" \
      org.opencontainers.image.description="Build worker image of the Varve automated packaging system" \
      org.opencontainers.image.authors="ShinKouyo <i@0x0f.dev>" \
      org.opencontainers.image.source="https://git.0x0f.dev/shkouyo/varve" \
      org.opencontainers.image.url="https://git.0x0f.dev/shkouyo/varve" \
      org.opencontainers.image.licenses="AGPL-3.0-or-later" \
      org.opencontainers.image.created="" \
      org.opencontainers.image.revision="" \
      org.opencontainers.image.version="" \
      org.opencontainers.image.documentation=""

# Pin the official default pacman.conf kept in the repository (archiso
# mode) so the image and repository stay in lockstep; add custom repos
# by editing container/worker/pacman.conf and rebuilding.
COPY container/worker/pacman.conf /etc/pacman.conf

# The base image ships no package database: refresh it with the pinned
# configuration before installing anything.
RUN pacman -Sy --noconfirm

# VCS tools for -git / -svn package builds; sudo lets makepkg install
# build dependencies (makepkg -s --syncdeps needs root).
RUN pacman -S --noconfirm git subversion sudo

# Agent binary. Build it beforehand with `go build ./cmd/varve-worker`.
COPY varve-worker /usr/bin/varve-worker

# Non-root build user; the agent runs entirely as builder and makepkg
# refuses to run as root.
RUN useradd -m builder \
    && printf 'builder ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/builder \
    && chmod 440 /etc/sudoers.d/builder

# Pre-create the repo-add work directory (default VARVE_DATA_DIR/work),
# owned by builder.
RUN install -d -o builder -g builder /var/lib/varve/work

USER builder
ENTRYPOINT ["varve-worker"]