mirror of
https://gitlab.archlinux.org/archlinux/archlinux-docker.git
synced 2026-03-28 10:21:01 +01:00
368a504fa3
When tar-ing the rootfs, the permissions preserved are from the worker process. This is not the intended behavior, as we want to preserve the permissions of the root user to most of the files. Use fakeroot during the tar process to automagically map the uid of the user to that of root's. Fixes #22 Signed-off-by: Santiago Torres <santiago@archlinux.org>
53 lines
2.2 KiB
Makefile
53 lines
2.2 KiB
Makefile
DOCKER_USER:=pierres
|
|
DOCKER_ORGANIZATION=archlinux
|
|
DOCKER_IMAGE:=base
|
|
BUILDDIR=build
|
|
PWD=$(shell pwd)
|
|
|
|
hooks:
|
|
mkdir -p alpm-hooks/usr/share/libalpm/hooks
|
|
find /usr/share/libalpm/hooks -exec ln -s /dev/null $(PWD)/alpm-hooks{} \;
|
|
|
|
rootfs: hooks
|
|
mkdir -vp $(BUILDDIR)/var/lib/pacman/
|
|
fakechroot -- fakeroot -- pacman -Sy -r $(BUILDDIR) \
|
|
--noconfirm --dbpath $(PWD)/$(BUILDDIR)/var/lib/pacman \
|
|
--config pacman.conf \
|
|
--noscriptlet \
|
|
--hookdir $(PWD)/alpm-hooks/usr/share/libalpm/hooks/ $(shell cat packages)
|
|
cp --recursive --preserve=timestamps --backup --suffix=.pacnew rootfs/* $(BUILDDIR)/
|
|
|
|
# remove passwordless login for root (see CVE-2019-5021 for reference)
|
|
sed -i -e 's/^root::/root:!:/' "$(BUILDDIR)/etc/shadow"
|
|
|
|
# fakeroot to map the gid/uid of the builder process to root
|
|
# fixes #22
|
|
fakeroot -- tar --numeric-owner --xattrs --acls --exclude-from=exclude -C $(BUILDDIR) -c . -f archlinux.tar
|
|
rm -rf $(BUILDDIR) alpm-hooks
|
|
|
|
compress-rootfs: archlinux.tar
|
|
xz archlinux.tar
|
|
|
|
docker-image: compress-rootfs
|
|
docker build -t $(DOCKER_ORGANIZATION)/$(DOCKER_IMAGE) .
|
|
|
|
docker-image-test: docker-image
|
|
# FIXME: /etc/mtab is hidden by docker so the stricter -Qkk fails
|
|
docker run --rm $(DOCKER_ORGANIZATION)/$(DOCKER_IMAGE) sh -c "/usr/bin/pacman -Sy && /usr/bin/pacman -Qqk"
|
|
docker run --rm $(DOCKER_ORGANIZATION)/$(DOCKER_IMAGE) sh -c "/usr/bin/pacman -Syu --noconfirm docker && docker -v"
|
|
# Ensure that the image does not include a private key
|
|
! docker run --rm $(DOCKER_ORGANIZATION)/$(DOCKER_IMAGE) pacman-key --lsign-key pierre@archlinux.de
|
|
docker run --rm $(DOCKER_ORGANIZATION)/$(DOCKER_IMAGE) sh -c "/usr/bin/id -u http"
|
|
docker run --rm $(DOCKER_ORGANIZATION)/$(DOCKER_IMAGE) sh -c "/usr/bin/pacman -Syu --noconfirm grep && locale | grep -q UTF-8"
|
|
|
|
ci-test:
|
|
docker run --rm --privileged --tmpfs=/tmp:exec --tmpfs=/run/shm -v /run/docker.sock:/run/docker.sock \
|
|
-v $(PWD):/app -w /app $(DOCKER_ORGANIZATION)/$(DOCKER_IMAGE) \
|
|
sh -c 'pacman -Syu --noconfirm fakechroot fakeroot make devtools docker && make docker-image-test'
|
|
|
|
docker-push:
|
|
docker login -u $(DOCKER_USER)
|
|
docker push $(DOCKER_ORGANIZATION)/$(DOCKER_IMAGE)
|
|
|
|
.PHONY: rootfs docker-image docker-image-test ci-test docker-push
|