mirror of
https://github.com/flatcar/scripts.git
synced 2025-12-22 17:52:12 +01:00
f05097d82f
* sdk: Fix ephemeral key directory paths baked into container images The SDK container build process was persisting temporary directory paths for module signing keys into /home/sdk/.bashrc. This caused all container instances to share the same ephemeral key location. Fixed by: - Runtime check in sdk_entry.sh to recreate stale temp directories - Build-time cleanup in Dockerfiles to remove the variables Each container instance now gets unique temporary directories. Signed-off-by: Daniel Zatovic <daniel.zatovic@gmail.com> * sdk_entry: use persistent module signing keys for unofficial builds For official builds (COREOS_OFFICIAL=1), continue using ephemeral temporary directories for module signing keys. For unofficial/development builds, use a persistent directory at /mnt/host/source/.module-signing-keys to preserve keys across container restarts. Signed-off-by: Daniel Zatovic <daniel.zatovic@gmail.com> --------- Signed-off-by: Daniel Zatovic <daniel.zatovic@gmail.com>
27 lines
1.0 KiB
Docker
27 lines
1.0 KiB
Docker
ARG BASE
|
|
|
|
FROM ${BASE}
|
|
COPY --chown=sdk:sdk sdk_container/ /mnt/host/source
|
|
COPY --chown=sdk:sdk . /mnt/host/source/src/scripts
|
|
|
|
# Disable all sandboxing for SDK updates since some core packages
|
|
# (like GO) fail to build from a permission error otherwise.
|
|
RUN cp /home/sdk/.bashrc /home/sdk/.bashrc.bak
|
|
RUN echo 'export FEATURES="-sandbox -usersandbox -ipc-sandbox -network-sandbox -pid-sandbox"' \
|
|
>> /home/sdk/.bashrc
|
|
|
|
RUN chown sdk:sdk /mnt/host/source
|
|
RUN /home/sdk/sdk_entry.sh ./update_chroot --toolchain_boards="amd64-usr arm64-usr"
|
|
|
|
RUN /home/sdk/sdk_entry.sh ./setup_board --board="arm64-usr" --regen_configs
|
|
RUN /home/sdk/sdk_entry.sh ./setup_board --board="amd64-usr" --regen_configs
|
|
|
|
# Restore original .bashrc to remove sandbox disablement
|
|
RUN mv /home/sdk/.bashrc.bak /home/sdk/.bashrc
|
|
RUN chown sdk:sdk /home/sdk/.bashrc
|
|
|
|
# Clean up ephemeral key directory variables that were added during build
|
|
RUN sed -i -e '/export MODULE_SIGNING_KEY_DIR=/d' \
|
|
-e '/export MODULES_SIGN_KEY=/d' \
|
|
-e '/export MODULES_SIGN_CERT=/d' /home/sdk/.bashrc
|