mirror of
https://gitlab.archlinux.org/archlinux/archlinux-docker.git
synced 2025-12-27 04:51:09 +01:00
d47ca225ee
Closes #63. Using `zstd -T0 -8` instead of `gz -T0 -9` results in a larger rootfs file, but requires significantly less time and memory: ``` zstd -3 115M 1.60user 0.18system 0:00.32elapsed 557%CPU (0avgtext+0avgdata 130212maxresident)k zstd -6 107M 5.03user 0.24system 0:00.72elapsed 729%CPU (0avgtext+0avgdata 149660maxresident)k zstd -7 106M 7.33user 0.29system 0:01.04elapsed 728%CPU (0avgtext+0avgdata 174368maxresident)k zstd -8 105M 8.45user 0.27system 0:01.23elapsed 707%CPU (0avgtext+0avgdata 173008maxresident)k zstd -9 104M 9.35user 0.37system 0:01.42elapsed 683%CPU (0avgtext+0avgdata 335920maxresident)k zstd -13 104M 30.57user 0.31system 0:04.76elapsed 648%CPU (0avgtext+0avgdata 498740maxresident)k zstd -19 91M 132.06user 0.53system 0:21.98elapsed 603%CPU (0avgtext+0avgdata 1106328maxresident)k xz -9 81M 105.71user 0.58system 0:58.24elapsed 182%CPU (0avgtext+0avgdata 2006964maxresident)k ``` Additionally this drops bash from the build Dockerfile, since `SHELL` is not OCI compliant.
71 lines
2.6 KiB
Makefile
71 lines
2.6 KiB
Makefile
DOCKER=docker
|
|
BUILDDIR=$(shell pwd)/build
|
|
OUTPUTDIR=$(shell pwd)/output
|
|
|
|
define rootfs
|
|
mkdir -vp $(BUILDDIR)/alpm-hooks/usr/share/libalpm/hooks
|
|
find /usr/share/libalpm/hooks -exec ln -sf /dev/null $(BUILDDIR)/alpm-hooks{} \;
|
|
|
|
mkdir -vp $(BUILDDIR)/var/lib/pacman/ $(OUTPUTDIR)
|
|
install -Dm644 /usr/share/devtools/pacman-extra.conf $(BUILDDIR)/etc/pacman.conf
|
|
cat pacman-conf.d-noextract.conf >> $(BUILDDIR)/etc/pacman.conf
|
|
|
|
fakechroot -- fakeroot -- pacman -Sy -r $(BUILDDIR) \
|
|
--noconfirm --dbpath $(BUILDDIR)/var/lib/pacman \
|
|
--config $(BUILDDIR)/etc/pacman.conf \
|
|
--noscriptlet \
|
|
--hookdir $(BUILDDIR)/alpm-hooks/usr/share/libalpm/hooks/ $(2)
|
|
|
|
cp --recursive --preserve=timestamps --backup --suffix=.pacnew rootfs/* $(BUILDDIR)/
|
|
|
|
fakechroot -- fakeroot -- chroot $(BUILDDIR) update-ca-trust
|
|
fakechroot -- fakeroot -- chroot $(BUILDDIR) locale-gen
|
|
fakechroot -- fakeroot -- chroot $(BUILDDIR) sh -c 'pacman-key --init && pacman-key --populate archlinux && bash -c "rm -rf etc/pacman.d/gnupg/{openpgp-revocs.d/,private-keys-v1.d/,pubring.gpg~,gnupg.S.}*"'
|
|
|
|
ln -fs /usr/lib/os-release $(BUILDDIR)/etc/os-release
|
|
|
|
# add system users
|
|
fakechroot -- fakeroot -- chroot $(BUILDDIR) /usr/bin/systemd-sysusers --root "/"
|
|
|
|
# remove passwordless login for root (see CVE-2019-5021 for reference)
|
|
sed -i -e 's/^root::/root:!:/' "$(BUILDDIR)/etc/shadow"
|
|
|
|
# fakeroot to map the gid/uid of the builder process to root
|
|
# fixes #22
|
|
fakeroot -- tar --numeric-owner --xattrs --acls --exclude-from=exclude -C $(BUILDDIR) -c . -f $(OUTPUTDIR)/$(1).tar
|
|
|
|
cd $(OUTPUTDIR); zstd -T0 -8 $(1).tar; sha256sum $(1).tar.zst > $(1).tar.zst.SHA256
|
|
endef
|
|
|
|
define dockerfile
|
|
sed -e "s|TEMPLATE_ROOTFS_FILE|$(1).tar.zst|" \
|
|
-e "s|TEMPLATE_ROOTFS_RELEASE_URL|Local build|" \
|
|
-e "s|TEMPLATE_ROOTFS_DOWNLOAD|ROOTFS=\"$(1).tar.zst\"|" \
|
|
-e "s|TEMPLATE_ROOTFS_HASH|$$(cat $(OUTPUTDIR)/$(1).tar.zst.SHA256)|" \
|
|
Dockerfile.template > $(OUTPUTDIR)/Dockerfile.$(1)
|
|
endef
|
|
|
|
.PHONY: clean
|
|
clean:
|
|
rm -rf $(BUILDDIR) $(OUTPUTDIR)
|
|
|
|
$(OUTPUTDIR)/base.tar.zst:
|
|
$(call rootfs,base,base)
|
|
|
|
$(OUTPUTDIR)/base-devel.tar.zst:
|
|
$(call rootfs,base-devel,base base-devel)
|
|
|
|
$(OUTPUTDIR)/Dockerfile.base: $(OUTPUTDIR)/base.tar.zst
|
|
$(call dockerfile,base)
|
|
|
|
$(OUTPUTDIR)/Dockerfile.base-devel: $(OUTPUTDIR)/base-devel.tar.zst
|
|
$(call dockerfile,base-devel)
|
|
|
|
.PHONY: docker-image-base
|
|
image-base: $(OUTPUTDIR)/Dockerfile.base
|
|
${DOCKER} build -f $(OUTPUTDIR)/Dockerfile.base -t archlinux/archlinux:base $(OUTPUTDIR)
|
|
|
|
.PHONY: docker-image-base-devel
|
|
image-base-devel: $(OUTPUTDIR)/Dockerfile.base-devel
|
|
${DOCKER} build -f $(OUTPUTDIR)/Dockerfile.base-devel -t archlinux/archlinux:base-devel $(OUTPUTDIR)
|