mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 04:36:40 +00:00
kevinveenbirkenbachandClaude Opus 5
8d8701d9b3
The ubuntu CI image build (job 103277644636) hung on Canonical's archive: apt fetched 26 MB at 417 kB/s, then 61.6 kB in 29 s, then sat on the package download until the job was cancelled after 23 minutes, while download.docker.com delivered 42.8 MB in under a second on the same runner. Locally archive.ubuntu.com and security.ubuntu.com took 20-26 s to the first byte against 2 s for a university mirror. INFINITO_APT_UBUNTU_MIRRORS in default.env is now the one list of Ubuntu mirrors, in failover order: de.archive.ubuntu.com, ftp.fau.de, ftp.halifax.rwth-aachen.de, archive.ubuntu.com. - Image builds: the Dockerfile sources the list alongside the install scripts and runs scripts/install/apt-mirrors.sh first. In an image with ubuntu.sources it points both stanzas at apt's mirror+file method, priorities in list order, and sets Acquire::http::Timeout to 10 s, so apt moves on from a mirror that fails or goes silent; other distros are untouched. In ubuntu:latest apt-get update took 8 s against 110 s on the stock sources, a dead first mirror was left behind within 25 s against 62 s on apt's defaults, and the swarm node packages (80 debs) came in 17 s. The Dockerfile's own RUN lines ran clean on ubuntu, debian, fedora and arch. - Package cache: package.sh proxies the first entry as the primary Ubuntu repos and the second as their fallback. Nexus revalidates metadata on every request here (metadataMaxAge 0), which costs a full download from a mirror without an ETag; both de.archive and ftp.fau.de send one, and the 15 MB universe index now comes back from the cache in 0.02 s. - tests/external/repository/test_apt_ubuntu_mirrors.py keeps the list honest: the first mirror must answer InRelease within 5 s (median of three) or the test names a faster later one, no mirror's -updates may lag the freshest by more than 24 h, and every entry must be the primary archive, a Canonical country alias or an enabled official mirror in Launchpad's registry. It caught the first draft of the list: mirrors.edge.kernel.org is not an official Ubuntu mirror. After pulling, an existing checkout needs `make dotenv-force`: plain `make dotenv` re-reads the old .env through BASH_ENV and keeps its values. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
63 lines
2.4 KiB
Docker
63 lines
2.4 KiB
Docker
# Base image (pkgmgr) selector. SPOT lives in default.env's
|
|
# INFINITO_PARENT_IMAGE and is forwarded as a build arg by compose.yml /
|
|
# scripts/image/build.sh.
|
|
# Example values:
|
|
# INFINITO_PARENT_IMAGE=ghcr.io/kevinveenbirkenbach/pkgmgr-arch:stable
|
|
ARG INFINITO_PARENT_IMAGE
|
|
FROM ${INFINITO_PARENT_IMAGE} AS full
|
|
|
|
ARG NIX_CONFIG
|
|
|
|
ARG INFINITO_SRC_DIR
|
|
ENV INFINITO_SRC_DIR=${INFINITO_SRC_DIR}
|
|
ARG INFINITO_VENV_DIR
|
|
ENV INFINITO_VENV_DIR=${INFINITO_VENV_DIR}
|
|
ENV PYTHON="${INFINITO_VENV_DIR}/bin/python"
|
|
ENV PIP="${INFINITO_VENV_DIR}/bin/python -m pip"
|
|
ENV PATH="${INFINITO_VENV_DIR}/bin:${PATH}"
|
|
|
|
# hadolint DL4006: ensure pipefail is set for RUN instructions that use pipes
|
|
SHELL ["/bin/bash", "-o", "pipefail", "-lc"]
|
|
|
|
RUN set -euo pipefail; \
|
|
cat /etc/os-release || true; \
|
|
if [ -f /etc/nix/nix.conf ]; then \
|
|
grep -q '^accept-flake-config *= *true' /etc/nix/nix.conf || \
|
|
echo 'accept-flake-config = true' >> /etc/nix/nix.conf; \
|
|
fi
|
|
|
|
COPY . ${INFINITO_SRC_DIR}
|
|
|
|
# hadolint ignore=DL3008,DL3033,DL3041,SC1090
|
|
RUN set -euo pipefail; \
|
|
source <(grep -hE '^INFINITO_((PYTHON|DOCKER_CLI|PACKAGE|FILESYSTEM|INTERPRETERS)_INSTALL_SCRIPT|APT_UBUNTU_MIRRORS)=' "${INFINITO_SRC_DIR}/default.env"); \
|
|
INFINITO_APT_UBUNTU_MIRRORS="${INFINITO_APT_UBUNTU_MIRRORS:?}" /bin/bash "${INFINITO_SRC_DIR}/scripts/install/apt-mirrors.sh"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_PYTHON_INSTALL_SCRIPT:?}"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_DOCKER_CLI_INSTALL_SCRIPT:?}"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_PACKAGE_INSTALL_SCRIPT:?}"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_FILESYSTEM_INSTALL_SCRIPT:?}"; \
|
|
/bin/bash "${INFINITO_SRC_DIR}/${INFINITO_INTERPRETERS_INSTALL_SCRIPT:?}"
|
|
|
|
RUN set -euo pipefail; \
|
|
systemctl mask systemd-firstboot.service first-boot-complete.target || true; \
|
|
systemd-machine-id-setup || true
|
|
|
|
ENV container=docker
|
|
STOPSIGNAL SIGRTMIN+3
|
|
|
|
# hadolint ignore=SC3040
|
|
RUN set -euo pipefail; \
|
|
export NIX_CONFIG="${NIX_CONFIG:-}"; \
|
|
"${INFINITO_SRC_DIR}/scripts/docker/entry.sh" --compile -- true
|
|
|
|
WORKDIR /
|
|
|
|
COPY scripts/docker/healthcheck.sh /usr/local/bin/healthcheck.sh
|
|
RUN chmod +x /usr/local/bin/healthcheck.sh
|
|
HEALTHCHECK --interval=5s --timeout=20s --start-period=30s --retries=20 \
|
|
CMD ["/usr/local/bin/healthcheck.sh"]
|
|
|
|
ENTRYPOINT ["/bin/bash", "-c", "exec \"${INFINITO_SRC_DIR}/scripts/docker/entry.sh\" \"$@\"", "--"]
|
|
|
|
CMD ["/sbin/init"]
|