51 lines
2.1 KiB
Docker
51 lines
2.1 KiB
Docker
# The toolchain installer image. It does NOT run the cluster — it installs a toolchain
|
|
# onto the host and gets out of the way.
|
|
#
|
|
# This exists to kill a bootstrap paradox: a plain bash installer needs curl, jq
|
|
# and sha256sum to already be present, and a minimal Debian has none of them.
|
|
# It carries its own toolchain, so the only host prerequisite is Docker.
|
|
#
|
|
# Two variants from one file:
|
|
# docker build -f ctrl/Dockerfile.deps --target deps -t <slug>-deps .
|
|
# docker build -f ctrl/Dockerfile.deps --target deps-full -t <slug>-deps:full .
|
|
#
|
|
# deps-full bakes every pinned binary in at build time. `docker save` it and
|
|
# you have the whole installer as one file to carry into an air-gapped network.
|
|
|
|
FROM debian:trixie-slim AS deps
|
|
|
|
# ca-certificates + curl: fetch and verify. graphviz + python3: render diagrams
|
|
# and validate the arch model, so the host never needs an apt package.
|
|
#
|
|
# docker-cli, NOT docker.io: we only ever talk to the host's daemon through the
|
|
# mounted socket, and under --no-install-recommends the docker.io package ships
|
|
# docker-init without the actual `docker` binary.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates curl jq graphviz python3 docker-cli \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# The installer is the generated standalone kit, not deps.sh plus the files it
|
|
# reads. A kit is one file with its pins frozen in and is proven to run with
|
|
# nothing else from rig present — which is exactly what an image needs, and
|
|
# `make standalone` keeps it current. Pins are the same in every profile's kit.
|
|
ARG PROFILE=minimal
|
|
WORKDIR /work
|
|
COPY standalone/${PROFILE}/rigdeps.sh /work/rigdeps.sh
|
|
RUN chmod +x /work/rigdeps.sh
|
|
|
|
# Defaults; every one is overridable with -e at run time.
|
|
ENV DEPS_SOURCE=upstream \
|
|
OUT_BIN=/out/bin \
|
|
HOST_ROOT=/host
|
|
|
|
ENTRYPOINT ["/work/rigdeps.sh"]
|
|
CMD ["install"]
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# deps-full — same image, binaries baked in, works with no network at all.
|
|
FROM deps AS deps-full
|
|
RUN /work/rigdeps.sh fetch --to /opt/rig/bin
|
|
ENV DEPS_SOURCE=baked \
|
|
BAKED_BIN=/opt/rig/bin
|