Fossil SCM

Dropped our canned /etc/os-release file entirely, recommending instead that those who need a VM-like container image switch the second stage from "scratch" to one of Google's "distroless" images, which provide that and more. That in turn gets rid of the need for the dummied up /usr/bin and /run, which simplifies the mainstream case.

wyoung 2023-03-24 08:07 trunk
Commit d778a023922249e6dbc235ab767bc0dc2f75d565f32f48c64dbd4e9ba3d4726b
Parent 2bdd5819e2f7413…
4 files changed +6 -8 +9 -11 -5 +6 -3
~ Dockerfile ~ containers/Dockerfile-nojail.patch - containers/os-release ~ www/containers.md
M Dockerfile
+6 -8
--- Dockerfile
+++ Dockerfile
@@ -59,11 +59,11 @@
5959
 ## ---------------------------------------------------------------------
6060
6161
 FROM scratch AS os
6262
 WORKDIR /jail
6363
 ARG UID=499
64
-ENV PATH "/bin:/usr/bin:/jail/bin"
64
+ENV PATH "/bin:/jail/bin"
6565
6666
 ### Lay BusyBox down as the first base layer. Coupled with the host's
6767
 ### kernel, this is the "OS" used to RUN the subsequent setup script.
6868
 COPY --from=builder /tmp/bbx/busybox /bin/
6969
 RUN [ "/bin/busybox", "--install", "/bin" ]
@@ -76,26 +76,24 @@
7676
 && echo "root:x:0:root" > /etc/group \
7777
 && echo "fossil:x:${UID}:${UID}:User:/jail:/false" >> /etc/passwd \
7878
 && echo "fossil:x:${UID}:fossil" >> /etc/group \
7979
 && install -d -m 700 -o fossil -g fossil log museum \
8080
 && install -d -m 755 -o fossil -g fossil dev \
81
- && install -d -m 755 -o root -g root /usr/bin \
82
- && install -d -m 400 -o root -g root /run \
8381
 && install -d -m 1777 -o root -g root /tmp \
8482
 && mknod -m 666 dev/null c 1 3 \
8583
 && mknod -m 444 dev/urandom c 1 9
8684
8785
 ### Do Fossil-specific things atop those base layers; this will change
8886
 ### as often as the Fossil build-from-source layer above.
8987
 COPY --from=builder /tmp/fossil bin/
9088
 RUN set -x \
91
- && ln -s /jail/bin/fossil /usr/bin/f \
92
- && echo -e '#!/bin/sh\nfossil sha1sum "$@"' > /usr/bin/sha1sum \
93
- && echo -e '#!/bin/sh\nfossil sha3sum "$@"' > /usr/bin/sha3sum \
89
+ && ln -s /jail/bin/fossil /bin/f \
90
+ && echo -e '#!/bin/sh\nfossil sha1sum "$@"' > /bin/sha1sum \
91
+ && echo -e '#!/bin/sh\nfossil sha3sum "$@"' > /bin/sha3sum \
9492
 && echo -e '#!/bin/sh\nfossil sqlite3 --no-repository "$@"' > \
95
- /usr/bin/sqlite3 \
96
- && chmod +x /usr/bin/sha?sum /usr/bin/sqlite3
93
+ /bin/sqlite3 \
94
+ && chmod +x /bin/sha?sum /bin/sqlite3
9795
9896
9997
 ## ---------------------------------------------------------------------
10098
 ## STAGE 3: Run!
10199
 ## ---------------------------------------------------------------------
102100
--- Dockerfile
+++ Dockerfile
@@ -59,11 +59,11 @@
59 ## ---------------------------------------------------------------------
60
61 FROM scratch AS os
62 WORKDIR /jail
63 ARG UID=499
64 ENV PATH "/bin:/usr/bin:/jail/bin"
65
66 ### Lay BusyBox down as the first base layer. Coupled with the host's
67 ### kernel, this is the "OS" used to RUN the subsequent setup script.
68 COPY --from=builder /tmp/bbx/busybox /bin/
69 RUN [ "/bin/busybox", "--install", "/bin" ]
@@ -76,26 +76,24 @@
76 && echo "root:x:0:root" > /etc/group \
77 && echo "fossil:x:${UID}:${UID}:User:/jail:/false" >> /etc/passwd \
78 && echo "fossil:x:${UID}:fossil" >> /etc/group \
79 && install -d -m 700 -o fossil -g fossil log museum \
80 && install -d -m 755 -o fossil -g fossil dev \
81 && install -d -m 755 -o root -g root /usr/bin \
82 && install -d -m 400 -o root -g root /run \
83 && install -d -m 1777 -o root -g root /tmp \
84 && mknod -m 666 dev/null c 1 3 \
85 && mknod -m 444 dev/urandom c 1 9
86
87 ### Do Fossil-specific things atop those base layers; this will change
88 ### as often as the Fossil build-from-source layer above.
89 COPY --from=builder /tmp/fossil bin/
90 RUN set -x \
91 && ln -s /jail/bin/fossil /usr/bin/f \
92 && echo -e '#!/bin/sh\nfossil sha1sum "$@"' > /usr/bin/sha1sum \
93 && echo -e '#!/bin/sh\nfossil sha3sum "$@"' > /usr/bin/sha3sum \
94 && echo -e '#!/bin/sh\nfossil sqlite3 --no-repository "$@"' > \
95 /usr/bin/sqlite3 \
96 && chmod +x /usr/bin/sha?sum /usr/bin/sqlite3
97
98
99 ## ---------------------------------------------------------------------
100 ## STAGE 3: Run!
101 ## ---------------------------------------------------------------------
102
--- Dockerfile
+++ Dockerfile
@@ -59,11 +59,11 @@
59 ## ---------------------------------------------------------------------
60
61 FROM scratch AS os
62 WORKDIR /jail
63 ARG UID=499
64 ENV PATH "/bin:/jail/bin"
65
66 ### Lay BusyBox down as the first base layer. Coupled with the host's
67 ### kernel, this is the "OS" used to RUN the subsequent setup script.
68 COPY --from=builder /tmp/bbx/busybox /bin/
69 RUN [ "/bin/busybox", "--install", "/bin" ]
@@ -76,26 +76,24 @@
76 && echo "root:x:0:root" > /etc/group \
77 && echo "fossil:x:${UID}:${UID}:User:/jail:/false" >> /etc/passwd \
78 && echo "fossil:x:${UID}:fossil" >> /etc/group \
79 && install -d -m 700 -o fossil -g fossil log museum \
80 && install -d -m 755 -o fossil -g fossil dev \
 
 
81 && install -d -m 1777 -o root -g root /tmp \
82 && mknod -m 666 dev/null c 1 3 \
83 && mknod -m 444 dev/urandom c 1 9
84
85 ### Do Fossil-specific things atop those base layers; this will change
86 ### as often as the Fossil build-from-source layer above.
87 COPY --from=builder /tmp/fossil bin/
88 RUN set -x \
89 && ln -s /jail/bin/fossil /bin/f \
90 && echo -e '#!/bin/sh\nfossil sha1sum "$@"' > /bin/sha1sum \
91 && echo -e '#!/bin/sh\nfossil sha3sum "$@"' > /bin/sha3sum \
92 && echo -e '#!/bin/sh\nfossil sqlite3 --no-repository "$@"' > \
93 /bin/sqlite3 \
94 && chmod +x /bin/sha?sum /bin/sqlite3
95
96
97 ## ---------------------------------------------------------------------
98 ## STAGE 3: Run!
99 ## ---------------------------------------------------------------------
100
M containers/Dockerfile-nojail.patch
+9 -11
--- containers/Dockerfile-nojail.patch
+++ containers/Dockerfile-nojail.patch
@@ -9,40 +9,38 @@
99
1010
 FROM scratch AS os
1111
 -WORKDIR /jail
1212
 +WORKDIR /
1313
 ARG UID=499
14
--ENV PATH "/bin:/usr/bin:/jail/bin"
15
-+ENV PATH "/bin:/usr/bin"
14
+-ENV PATH "/bin:/jail/bin"
15
++ENV PATH "/bin"
1616
1717
 ### Lay BusyBox down as the first base layer. Coupled with the host's
1818
 ### kernel, this is the "OS" used to RUN the subsequent setup script.
1919
 COPY --from=builder /tmp/bbx/busybox /bin/
2020
 RUN [ "/bin/busybox", "--install", "/bin" ]
2121
 @@ -78,19 +78,17 @@
2222
 && echo "fossil:x:${UID}:fossil" >> /etc/group \
2323
 && install -d -m 700 -o fossil -g fossil log museum \
2424
 && install -d -m 755 -o fossil -g fossil dev \
25
- && install -d -m 755 -o root -g root /usr/bin \
26
- && install -d -m 400 -o root -g root /run \
2725
 - && install -d -m 1777 -o root -g root /tmp \
2826
 - && mknod -m 666 dev/null c 1 3 \
2927
 - && mknod -m 444 dev/urandom c 1 9
3028
 + && install -d -m 1777 -o root -g root /tmp
3129
3230
 ### Do Fossil-specific things atop those base layers; this will change
3331
 ### as often as the Fossil build-from-source layer above.
3432
 -COPY --from=builder /tmp/fossil bin/
35
-+COPY --from=builder /tmp/fossil /usr/bin/
33
++COPY --from=builder /tmp/fossil /bin/
3634
 RUN set -x \
37
-- && ln -s /jail/bin/fossil /usr/bin/f \
38
-+ && ln -s /usr/bin/fossil /usr/bin/f \
39
- && echo -e '#!/bin/sh\nfossil sha1sum "$@"' > /usr/bin/sha1sum \
40
- && echo -e '#!/bin/sh\nfossil sha3sum "$@"' > /usr/bin/sha3sum \
35
+- && ln -s /jail/bin/fossil /bin/f \
36
++ && ln -s /bin/fossil /bin/f \
37
+ && echo -e '#!/bin/sh\nfossil sha1sum "$@"' > /bin/sha1sum \
38
+ && echo -e '#!/bin/sh\nfossil sha3sum "$@"' > /bin/sha3sum \
4139
 && echo -e '#!/bin/sh\nfossil sqlite3 --no-repository "$@"' > \
42
- /usr/bin/sqlite3 \
43
- && chmod +x /usr/bin/sha?sum /usr/bin/sqlite3
40
+ /bin/sqlite3 \
41
+ && chmod +x /bin/sha?sum /bin/sqlite3
4442
 @@ -101,10 +99,9 @@
4543
 ## ---------------------------------------------------------------------
4644
4745
 EXPOSE 8080/tcp
4846
 CMD [ \
4947
5048
DELETED containers/os-release
--- containers/Dockerfile-nojail.patch
+++ containers/Dockerfile-nojail.patch
@@ -9,40 +9,38 @@
9
10 FROM scratch AS os
11 -WORKDIR /jail
12 +WORKDIR /
13 ARG UID=499
14 -ENV PATH "/bin:/usr/bin:/jail/bin"
15 +ENV PATH "/bin:/usr/bin"
16
17 ### Lay BusyBox down as the first base layer. Coupled with the host's
18 ### kernel, this is the "OS" used to RUN the subsequent setup script.
19 COPY --from=builder /tmp/bbx/busybox /bin/
20 RUN [ "/bin/busybox", "--install", "/bin" ]
21 @@ -78,19 +78,17 @@
22 && echo "fossil:x:${UID}:fossil" >> /etc/group \
23 && install -d -m 700 -o fossil -g fossil log museum \
24 && install -d -m 755 -o fossil -g fossil dev \
25 && install -d -m 755 -o root -g root /usr/bin \
26 && install -d -m 400 -o root -g root /run \
27 - && install -d -m 1777 -o root -g root /tmp \
28 - && mknod -m 666 dev/null c 1 3 \
29 - && mknod -m 444 dev/urandom c 1 9
30 + && install -d -m 1777 -o root -g root /tmp
31
32 ### Do Fossil-specific things atop those base layers; this will change
33 ### as often as the Fossil build-from-source layer above.
34 -COPY --from=builder /tmp/fossil bin/
35 +COPY --from=builder /tmp/fossil /usr/bin/
36 RUN set -x \
37 - && ln -s /jail/bin/fossil /usr/bin/f \
38 + && ln -s /usr/bin/fossil /usr/bin/f \
39 && echo -e '#!/bin/sh\nfossil sha1sum "$@"' > /usr/bin/sha1sum \
40 && echo -e '#!/bin/sh\nfossil sha3sum "$@"' > /usr/bin/sha3sum \
41 && echo -e '#!/bin/sh\nfossil sqlite3 --no-repository "$@"' > \
42 /usr/bin/sqlite3 \
43 && chmod +x /usr/bin/sha?sum /usr/bin/sqlite3
44 @@ -101,10 +99,9 @@
45 ## ---------------------------------------------------------------------
46
47 EXPOSE 8080/tcp
48 CMD [ \
49
50 ELETED containers/os-release
--- containers/Dockerfile-nojail.patch
+++ containers/Dockerfile-nojail.patch
@@ -9,40 +9,38 @@
9
10 FROM scratch AS os
11 -WORKDIR /jail
12 +WORKDIR /
13 ARG UID=499
14 -ENV PATH "/bin:/jail/bin"
15 +ENV PATH "/bin"
16
17 ### Lay BusyBox down as the first base layer. Coupled with the host's
18 ### kernel, this is the "OS" used to RUN the subsequent setup script.
19 COPY --from=builder /tmp/bbx/busybox /bin/
20 RUN [ "/bin/busybox", "--install", "/bin" ]
21 @@ -78,19 +78,17 @@
22 && echo "fossil:x:${UID}:fossil" >> /etc/group \
23 && install -d -m 700 -o fossil -g fossil log museum \
24 && install -d -m 755 -o fossil -g fossil dev \
 
 
25 - && install -d -m 1777 -o root -g root /tmp \
26 - && mknod -m 666 dev/null c 1 3 \
27 - && mknod -m 444 dev/urandom c 1 9
28 + && install -d -m 1777 -o root -g root /tmp
29
30 ### Do Fossil-specific things atop those base layers; this will change
31 ### as often as the Fossil build-from-source layer above.
32 -COPY --from=builder /tmp/fossil bin/
33 +COPY --from=builder /tmp/fossil /bin/
34 RUN set -x \
35 - && ln -s /jail/bin/fossil /bin/f \
36 + && ln -s /bin/fossil /bin/f \
37 && echo -e '#!/bin/sh\nfossil sha1sum "$@"' > /bin/sha1sum \
38 && echo -e '#!/bin/sh\nfossil sha3sum "$@"' > /bin/sha3sum \
39 && echo -e '#!/bin/sh\nfossil sqlite3 --no-repository "$@"' > \
40 /bin/sqlite3 \
41 && chmod +x /bin/sha?sum /bin/sqlite3
42 @@ -101,10 +99,9 @@
43 ## ---------------------------------------------------------------------
44
45 EXPOSE 8080/tcp
46 CMD [ \
47
48 ELETED containers/os-release
D containers/os-release
-5
--- a/containers/os-release
+++ b/containers/os-release
@@ -1,5 +0,0 @@
1
-NAME="Fossil BusyBox"
2
-ID="fslbbx"
3
-VERSION="Fossil 2"
4
-HOME_URL="https://fossil-scm.org/home/doc/trunk/www/containers.md"
5
-BUG_REPORT_URL="https://fossil-scm.org/forum"
--- a/containers/os-release
+++ b/containers/os-release
@@ -1,5 +0,0 @@
1 NAME="Fossil BusyBox"
2 ID="fslbbx"
3 VERSION="Fossil 2"
4 HOME_URL="https://fossil-scm.org/home/doc/trunk/www/containers.md"
5 BUG_REPORT_URL="https://fossil-scm.org/forum"
--- a/containers/os-release
+++ b/containers/os-release
@@ -1,5 +0,0 @@
 
 
 
 
 
M www/containers.md
+6 -3
--- www/containers.md
+++ www/containers.md
@@ -740,17 +740,20 @@
740740
 this naming scheme in the examples below so that you will be able to
741741
 replace the “`myproject`” element of the various file and path names.
742742
743743
 If you use [the stock `Dockerfile`][DF] to generate your
744744
 base image, `nspawn` won’t recognize it as containing an OS unless you
745
-put a line like this into the first stage:
745
+change the “`FROM scratch AS os`” line at the top of the second stage
746
+to something like this:
746747
747748
 ```
748
- COPY containers/os-release /etc/os-release
749
+ FROM gcr.io/distroless/static-debian11 AS os
749750
 ```
750751
751
-That will let you produce a `systemd` “machine” via the OCI image:
752
+Using that as a base image provides all the files `nspawn` checks for to
753
+determine whether the container is sufficiently close to a Linux VM for
754
+the following step to proceed:
752755
753756
 ```
754757
 $ make container
755758
 $ docker container export $(make container-version) |
756759
 machinectl import-tar - myproject
757760
--- www/containers.md
+++ www/containers.md
@@ -740,17 +740,20 @@
740 this naming scheme in the examples below so that you will be able to
741 replace the “`myproject`” element of the various file and path names.
742
743 If you use [the stock `Dockerfile`][DF] to generate your
744 base image, `nspawn` won’t recognize it as containing an OS unless you
745 put a line like this into the first stage:
 
746
747 ```
748 COPY containers/os-release /etc/os-release
749 ```
750
751 That will let you produce a `systemd` “machine” via the OCI image:
 
 
752
753 ```
754 $ make container
755 $ docker container export $(make container-version) |
756 machinectl import-tar - myproject
757
--- www/containers.md
+++ www/containers.md
@@ -740,17 +740,20 @@
740 this naming scheme in the examples below so that you will be able to
741 replace the “`myproject`” element of the various file and path names.
742
743 If you use [the stock `Dockerfile`][DF] to generate your
744 base image, `nspawn` won’t recognize it as containing an OS unless you
745 change the “`FROM scratch AS os`” line at the top of the second stage
746 to something like this:
747
748 ```
749 FROM gcr.io/distroless/static-debian11 AS os
750 ```
751
752 Using that as a base image provides all the files `nspawn` checks for to
753 determine whether the container is sufficiently close to a Linux VM for
754 the following step to proceed:
755
756 ```
757 $ make container
758 $ docker container export $(make container-version) |
759 machinectl import-tar - myproject
760

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button